AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks

Original release date: May 11, 2021

Summary

This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 9. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are aware of a ransomware attack affecting a critical infrastructure (CI) entity—a pipeline company—in the United States. Malicious cyber actors deployed DarkSide ransomware against the pipeline company’s information technology (IT) network.[1] At this time, there is no indication that the entity’s operational technology (OT) networks have been directly affected by the ransomware.

CISA and FBI urge CI asset owners and operators to adopt a heightened state of awareness and implement the recommendations listed in the Mitigations section of this Joint Cybersecurity Advisory, including implementing robust network segmentation between IT and OT networks; regularly testing manual controls; and ensuring that backups are implemented, regularly tested, and isolated from network connections. These mitigations will help CI owners and operators improve their entity’s functional resilience by reducing their vulnerability to ransomware and the risk of severe business degradation if impacted by ransomware.

Click here for a PDF version of this report.

Technical Details

Note: the analysis in this Joint Cybersecurity Advisory is ongoing, and the information provided should not be considered comprehensive. CISA and FBI will update this advisory as new information is available.

After gaining initial access to the pipeline company’s network, DarkSide actors deployed DarkSide ransomware against the company’s IT network. In response to the cyberattack, the company has reported that they proactively disconnected certain OT systems to ensure the systems’ safety.[2] At this time, there are no indications that the threat actor moved laterally to OT systems.

DarkSide is ransomware-as-a-service (RaaS)—the developers of the ransomware receive a share of the proceeds from the cybercriminal actors who deploy it, known as “affiliates.” According to open-source reporting, since August 2020, DarkSide actors have been targeting multiple large, high-revenue organizations, resulting in the encryption and theft of sensitive data. The DarkSide group has publicly stated that they prefer to target organizations that can afford to pay large ransoms instead of hospitals, schools, non-profits, and governments.[3],[4]

According to open-source reporting, DarkSide actors have previously been observed gaining initial access through phishing and exploiting remotely accessible accounts and systems and Virtual Desktop Infrastructure (VDI) (Phishing [T1566], Exploit Public-Facing Application [T1190], External Remote Services [T1133]).[5],[6] DarkSide actors have also been observed using Remote Desktop Protocol (RDP) to maintain Persistence [TA0003].[7]

After gaining access, DarkSide actors deploy DarkSide ransomware to encrypt and steal sensitive data (Data Encrypted for Impact [T1486]). The actors then threaten to publicly release the data if the ransom is not paid.[8],[9] The DarkSide ransomware uses Salsa20 and RSA encryption.[10]

DarkSide actors primarily use The Onion Router (TOR) for Command and Control (C2) [TA0011] (Proxy: Multi-hop Proxy [1090.003]).[11],[12] The actors have also been observed using Cobalt Strike for C2.[13]

Mitigations

CISA and FBI urge CI owners and operators to apply the following mitigations to reduce the risk of compromise by ransomware attacks.

Require multi-factor authentication for remote access to OT and IT networks.
Enable strong spam filters to prevent phishing emails from reaching end users. Filter emails containing executable files from reaching end users.
Implement a user training program and simulated attacks for spearphishing to discourage users from visiting malicious websites or opening malicious attachments and re-enforce the appropriate user responses to spearphishing emails.
Filter network traffic to prohibit ingress and egress communications with known malicious IP addresses. Prevent users from accessing malicious websites by implementing URL blocklists and/or allowlists.
Update software, including operating systems, applications, and firmware on IT network assets, in a timely manner. Consider using a centralized patch management system; use a risk-based assessment strategy to determine which OT network assets and zones should participate in the patch management program.
Limit access to resources over networks, especially by restricting RDP. After assessing risks, if RDP is deemed operationally necessary, restrict the originating sources and require multi-factor authentication.
Set antivirus/antimalware programs to conduct regular scans of IT network assets using up-to-date signatures. Use a risk-based asset inventory strategy to determine how OT network assets are identified and evaluated for the presence of malware.
Implement unauthorized execution prevention by: 

Disabling macro scripts from Microsoft Office files transmitted via email. Consider using Office Viewer software to open Microsoft Office files transmitted via email instead of full Microsoft Office suite applications.
Implementing application allowlisting, which only allows systems to execute programs known and permitted by security policy. Implement software restriction policies (SRPs) or other controls to prevent programs from executing from common ransomware locations, such as temporary folders supporting popular internet browsers or compression/decompression programs, including the AppData/LocalAppData folder.
Monitor and/or block inbound connections from Tor exit nodes and other anonymization services to IP addresses and ports for which external connections are not expected (i.e., other than VPN gateways, mail ports, web ports). For more guidance, refer to Joint Cybersecurity Advisory AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor.
Deploy signatures to detect and/or block inbound connection from Cobalt Strike servers and other post exploitation tools.

CISA and FBI urge CI owners and operators to apply the following mitigations now to reduce the risk of severe business or functional degradation should their CI entity fall victim to a ransomware attack in the future.

Implement and ensure robust network segmentation between IT and OT networks to limit the ability of adversaries to pivot to the OT network even if the IT network is compromised. Define a demilitarized zone that eliminates unregulated communication between the IT and OT networks.
Organize OT assets into logical zones by taking into account criticality, consequence, and operational necessity. Define acceptable communication conduits between the zones and deploy security controls to filter network traffic and monitor communications between zones. Prohibit industrial control system (ICS) protocols from traversing the IT network.
Identify OT and IT network inter-dependencies and develop workarounds or manual controls to ensure ICS networks can be isolated if the connections create risk to the safe and reliable operation of OT processes. Regularly test contingency plans such as manual controls so that safety critical functions can be maintained during a cyber incident. Ensure that the OT network can operate at necessary capacity even if the IT network is compromised. 
Regularly test manual controls so that critical functions can be kept running if ICS or OT networks need to be taken offline.
Implement regular data backup procedures on both the IT and OT networks. Backup procedures should be conducted on a frequent, regular basis. The data backup procedures should also address the following best practices:

Ensure that backups are regularly tested.
Store your backups separately. Backups should be isolated from network connections that could enable the spread of ransomware. It is important that backups be maintained offline as many ransomware variants attempt to find and encrypt or delete accessible backups. Maintaining current backups offline is critical because if your network data is encrypted with ransomware, your organization can restore systems to its previous state. Best practice is to store your backups on a separate device that cannot be accessed from a network, such as on an external hard drive. (See the Software Engineering Institute’s page on ransomware).
Maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt. This entails maintaining image “templates” that include a preconfigured operating system (OS) and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server.
Retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred. Hardware that is newer or older than the primary system can present installation or compatibility hurdles when rebuilding from images.
Store source code or executables. It is more efficient to rebuild from system images, but some images will not install on different hardware or platforms correctly; having separate access to needed software will help in these cases.

Ensure user and process accounts are limited through account use policies, user account control, and privileged account management. Organize access rights based on the principles of least privilege and separation of duties.

If your organization is impacted by a ransomware incident, CISA and FBI recommend the following actions:

Isolate the infected system. Remove the infected system from all networks, and disable the computer’s wireless, Bluetooth, and any other potential networking capabilities. Ensure all shared and networked drives are disconnected, whether wired or wireless.  
Turn off other computers and devices. Power-off and segregate (i.e., remove from the network) the infected computer(s). Power-off and segregate any other computers or devices that shared a network with the infected computer(s) that have not been fully encrypted by ransomware. If possible, collect and secure all infected and potentially infected computers and devices in a central location, making sure to clearly label any computers that have been encrypted. Powering-off and segregating infected computers and computers that have not been fully encrypted may allow for the recovery of partially encrypted files by specialists. (See Before You Connect a New Computer to the Internet for tips on how to make a computer more secure before you reconnect it to a network.)
Secure your backups. Ensure that your backup data is offline and secure. If possible, scan your backup data with an antivirus program to check that it is free of malware.
Refer to Joint Cybersecurity Advisory: AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity for more best practices on incident response.

Note: CISA and the FBI do not encourage paying a ransom to criminal actors. Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or may fund illicit activities. Paying the ransom also does not guarantee that a victim’s files will be recovered. CISA and FBI urge you to report ransomware incidents to your local FBI field office.

CISA offers a range of no-cost cyber hygiene services to help CI organizations assess, identify and reduce their exposure to threats, including ransomware. By requesting these services, organizations of any size could find ways to reduce their risk and mitigate attack vectors.

Resources

CISA and MS-ISAC: Joint Ransomware Guide
CISA: Ransomware page
CISA Tip: Protecting Against Ransomware
CISA: CISA Ransomware One-Pager and Technical Document
CISA Insights: Ransomware Outbreak
CISA: Pipeline Cybersecurity Initiative
CISA Webinar: Combating Ransomware
CISA: Cybersecurity Practices for Industrial Control Systems
FBI: Incidents of Ransomware on the Rise
National Security Agency (NSA): Stop Malicious Cyber Activity Against Connected Operational Technology
Department of Energy: Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model
Transportation Security Agency: Pipeline Security Guidelines
National Institute of Standards and Technology (NIST): Framework for Improving Critical Infrastructure Cybersecurity
NIST: Ransomware Protection and Response
NIST: Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events
NIST: Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events
NIST: Data Integrity: Recovering from Ransomware and Other Destructive Events
NIST: Guide to Industrial Control Systems (ICS) Security
Software Engineering Institute: Ransomware: Best Practices for Prevention and Response

Contact Information

Victims of ransomware should report it immediately to CISA at https://us-cert.cisa.gov/report, a local FBI Field Office, or U.S. Secret Service Field Office. To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at CISAServiceDesk@cisa.dhs.gov.

References

[1] Colonial Pipeline Media Statement on Pipeline Disruption [2] Ibid [3] SonicWall: Darkside Ransomware Targets Large Corporations. Charges up to $2M. [4] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [5] BankInfo Security: FBI: DarkSide Ransomware Used in Colonial Pipeline Attack [6] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [7] Ibid [8] SonicWall: Darkside Ransomware Targets Large Corporations. Charges up to $2M [9] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [10] McAfee: Threat Landscape Dashboard DarkSide – Ransomware [11] SonicWall: Darkside Ransomware Targets Large Corporations. Charges up to $2M [12] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [13] McAfee: Threat Landscape Dashboard DarkSide – Ransomware

Revisions

May 11, 2021: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Read More

The post AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/aa21-131a-darkside-ransomware-best-practices-for-preventing-business-disruption-from-ransomware-attacks-2/?utm_source=rss&utm_medium=rss&utm_campaign=aa21-131a-darkside-ransomware-best-practices-for-preventing-business-disruption-from-ransomware-attacks-2

AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks

Original release date: May 11, 2021SummaryThis Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 9. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are aware of a ransomware attack affecting a critical infrastructure (CI) entity—a pipeline company—in the United States. Malicious cyber actors deployed DarkSide ransomware against the pipeline company’s information technology (IT) network.[1] At this time, there is no indication that the entity’s operational technology (OT) networks have been directly affected by the ransomware.

CISA and FBI urge CI asset owners and operators to adopt a heightened state of awareness and implement the recommendations listed in the Mitigations section of this Joint Cybersecurity Advisory, including implementing robust network segmentation between IT and OT networks; regularly testing manual controls; and ensuring that backups are implemented, regularly tested, and isolated from network connections. These mitigations will help CI owners and operators improve their entity’s functional resilience by reducing their vulnerability to ransomware and the risk of severe business degradation if impacted by ransomware.

Click here for a PDF version of this report.
Technical DetailsNote: the analysis in this Joint Cybersecurity Advisory is ongoing, and the information provided should not be considered comprehensive. CISA and FBI will update this advisory as new information is available.

After gaining initial access to the pipeline company’s network, DarkSide actors deployed DarkSide ransomware against the company’s IT network. In response to the cyberattack, the company has reported that they proactively disconnected certain OT systems to ensure the systems’ safety.[2] At this time, there are no indications that the threat actor moved laterally to OT systems.

DarkSide is ransomware-as-a-service (RaaS)—the developers of the ransomware receive a share of the proceeds from the cybercriminal actors who deploy it, known as “affiliates.” According to open-source reporting, since August 2020, DarkSide actors have been targeting multiple large, high-revenue organizations, resulting in the encryption and theft of sensitive data. The DarkSide group has publicly stated that they prefer to target organizations that can afford to pay large ransoms instead of hospitals, schools, non-profits, and governments.[3],[4]

According to open-source reporting, DarkSide actors have previously been observed gaining initial access through phishing and exploiting remotely accessible accounts and systems and Virtual Desktop Infrastructure (VDI) (Phishing [T1566], Exploit Public-Facing Application [T1190], External Remote Services [T1133]).[5],[6] DarkSide actors have also been observed using Remote Desktop Protocol (RDP) to maintain Persistence [TA0003].[7]

After gaining access, DarkSide actors deploy DarkSide ransomware to encrypt and steal sensitive data (Data Encrypted for Impact [T1486]). The actors then threaten to publicly release the data if the ransom is not paid.[8],[9] The DarkSide ransomware uses Salsa20 and RSA encryption.[10]

DarkSide actors primarily use The Onion Router (TOR) for Command and Control (C2) [TA0011] (Proxy: Multi-hop Proxy [1090.003]).[11],[12] The actors have also been observed using Cobalt Strike for C2.[13]
MitigationsCISA and FBI urge CI owners and operators to apply the following mitigations to reduce the risk of compromise by ransomware attacks.

Require multi-factor authentication for remote access to OT and IT networks.
Enable strong spam filters to prevent phishing emails from reaching end users. Filter emails containing executable files from reaching end users.
Implement a user training program and simulated attacks for spearphishing to discourage users from visiting malicious websites or opening malicious attachments and re-enforce the appropriate user responses to spearphishing emails.
Filter network traffic to prohibit ingress and egress communications with known malicious IP addresses. Prevent users from accessing malicious websites by implementing URL blocklists and/or allowlists.
Update software, including operating systems, applications, and firmware on IT network assets, in a timely manner. Consider using a centralized patch management system; use a risk-based assessment strategy to determine which OT network assets and zones should participate in the patch management program.
Limit access to resources over networks, especially by restricting RDP. After assessing risks, if RDP is deemed operationally necessary, restrict the originating sources and require multi-factor authentication.
Set antivirus/antimalware programs to conduct regular scans of IT network assets using up-to-date signatures. Use a risk-based asset inventory strategy to determine how OT network assets are identified and evaluated for the presence of malware.
Implement unauthorized execution prevention by: 

Disabling macro scripts from Microsoft Office files transmitted via email. Consider using Office Viewer software to open Microsoft Office files transmitted via email instead of full Microsoft Office suite applications.
Implementing application allowlisting, which only allows systems to execute programs known and permitted by security policy. Implement software restriction policies (SRPs) or other controls to prevent programs from executing from common ransomware locations, such as temporary folders supporting popular internet browsers or compression/decompression programs, including the AppData/LocalAppData folder.
Monitor and/or block inbound connections from Tor exit nodes and other anonymization services to IP addresses and ports for which external connections are not expected (i.e., other than VPN gateways, mail ports, web ports). For more guidance, refer to Joint Cybersecurity Advisory AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor.
Deploy signatures to detect and/or block inbound connection from Cobalt Strike servers and other post exploitation tools.

CISA and FBI urge CI owners and operators to apply the following mitigations now to reduce the risk of severe business or functional degradation should their CI entity fall victim to a ransomware attack in the future.

Implement and ensure robust network segmentation between IT and OT networks to limit the ability of adversaries to pivot to the OT network even if the IT network is compromised. Define a demilitarized zone that eliminates unregulated communication between the IT and OT networks.
Organize OT assets into logical zones by taking into account criticality, consequence, and operational necessity. Define acceptable communication conduits between the zones and deploy security controls to filter network traffic and monitor communications between zones. Prohibit industrial control system (ICS) protocols from traversing the IT network.
Identify OT and IT network inter-dependencies and develop workarounds or manual controls to ensure ICS networks can be isolated if the connections create risk to the safe and reliable operation of OT processes. Regularly test contingency plans such as manual controls so that safety critical functions can be maintained during a cyber incident. Ensure that the OT network can operate at necessary capacity even if the IT network is compromised. 
Regularly test manual controls so that critical functions can be kept running if ICS or OT networks need to be taken offline.
Implement regular data backup procedures on both the IT and OT networks. Backup procedures should be conducted on a frequent, regular basis. The data backup procedures should also address the following best practices:

Ensure that backups are regularly tested.
Store your backups separately. Backups should be isolated from network connections that could enable the spread of ransomware. It is important that backups be maintained offline as many ransomware variants attempt to find and encrypt or delete accessible backups. Maintaining current backups offline is critical because if your network data is encrypted with ransomware, your organization can restore systems to its previous state. Best practice is to store your backups on a separate device that cannot be accessed from a network, such as on an external hard drive. (See the Software Engineering Institute’s page on ransomware).
Maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt. This entails maintaining image “templates” that include a preconfigured operating system (OS) and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server.
Retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred. Hardware that is newer or older than the primary system can present installation or compatibility hurdles when rebuilding from images.
Store source code or executables. It is more efficient to rebuild from system images, but some images will not install on different hardware or platforms correctly; having separate access to needed software will help in these cases.

Ensure user and process accounts are limited through account use policies, user account control, and privileged account management. Organize access rights based on the principles of least privilege and separation of duties.

If your organization is impacted by a ransomware incident, CISA and FBI recommend the following actions:

Isolate the infected system. Remove the infected system from all networks, and disable the computer’s wireless, Bluetooth, and any other potential networking capabilities. Ensure all shared and networked drives are disconnected, whether wired or wireless.  
Turn off other computers and devices. Power-off and segregate (i.e., remove from the network) the infected computer(s). Power-off and segregate any other computers or devices that shared a network with the infected computer(s) that have not been fully encrypted by ransomware. If possible, collect and secure all infected and potentially infected computers and devices in a central location, making sure to clearly label any computers that have been encrypted. Powering-off and segregating infected computers and computers that have not been fully encrypted may allow for the recovery of partially encrypted files by specialists. (See Before You Connect a New Computer to the Internet for tips on how to make a computer more secure before you reconnect it to a network.)
Secure your backups. Ensure that your backup data is offline and secure. If possible, scan your backup data with an antivirus program to check that it is free of malware.
Refer to Joint Cybersecurity Advisory: AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity for more best practices on incident response.

Note: CISA and the FBI do not encourage paying a ransom to criminal actors. Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or may fund illicit activities. Paying the ransom also does not guarantee that a victim’s files will be recovered. CISA and FBI urge you to report ransomware incidents to your local FBI field office.

CISA offers a range of no-cost cyber hygiene services to help CI organizations assess, identify and reduce their exposure to threats, including ransomware. By requesting these services, organizations of any size could find ways to reduce their risk and mitigate attack vectors.

Resources

CISA and MS-ISAC: Joint Ransomware Guide
CISA: Ransomware page
CISA Tip: Protecting Against Ransomware
CISA: CISA Ransomware One-Pager and Technical Document
CISA Insights: Ransomware Outbreak
CISA: Pipeline Cybersecurity Initiative
CISA Webinar: Combating Ransomware
CISA: Cybersecurity Practices for Industrial Control Systems
FBI: Incidents of Ransomware on the Rise
National Security Agency (NSA): Stop Malicious Cyber Activity Against Connected Operational Technology
Department of Energy: Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model
Transportation Security Agency: Pipeline Security Guidelines
National Institute of Standards and Technology (NIST): Framework for Improving Critical Infrastructure Cybersecurity
NIST: Ransomware Protection and Response
NIST: Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events
NIST: Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events
NIST: Data Integrity: Recovering from Ransomware and Other Destructive Events
NIST: Guide to Industrial Control Systems (ICS) Security
Software Engineering Institute: Ransomware: Best Practices for Prevention and Response

Contact InformationVictims of ransomware should report it immediately to CISA at https://us-cert.cisa.gov/report, a local FBI Field Office, or U.S. Secret Service Field Office. To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at CISAServiceDesk@cisa.dhs.gov.
References
[1] Colonial Pipeline Media Statement on Pipeline Disruption [2] Ibid [3] SonicWall: Darkside Ransomware Targets Large Corporations. Charges up to $2M. [4] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [5] BankInfo Security: FBI: DarkSide Ransomware Used in Colonial Pipeline Attack [6] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [7] Ibid [8] SonicWall: Darkside Ransomware Targets Large Corporations. Charges up to $2M [9] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [10] McAfee: Threat Landscape Dashboard DarkSide – Ransomware [11] SonicWall: Darkside Ransomware Targets Large Corporations. Charges up to $2M [12] Varonis: Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign [13] McAfee: Threat Landscape Dashboard DarkSide – Ransomware Revisions
May 11, 2021: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.
Read More

The post AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/aa21-131a-darkside-ransomware-best-practices-for-preventing-business-disruption-from-ransomware-attacks/?utm_source=rss&utm_medium=rss&utm_campaign=aa21-131a-darkside-ransomware-best-practices-for-preventing-business-disruption-from-ransomware-attacks

ESB-2021.1581 – [Appliance] Traffix SDC: Access confidential data – Remote/unauthenticated

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.1581
Linux kernel vulnerability CVE-2020-1749
11 May 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: Traffix SDC
Publisher: F5 Networks
Operating System: Network Appliance
Impact/Access: Access Confidential Data — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-1749

Reference: ESB-2021.1212
ESB-2021.0377
ESB-2020.1204

Original Bulletin:
https://support.f5.com/csp/article/K02186513

– ————————–BEGIN INCLUDED TEXT——————–

K02186513: Linux kernel vulnerability CVE-2020-1749

Original Publication Date: 10 May, 2021

Security Advisory Description

A flaw was found in the Linux kernel’s implementation of some networking
protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an
encrypted tunnel is created between two hosts, the kernel isn’t correctly
routing tunneled data over the encrypted link; rather sending the data
unencrypted. This would allow anyone in between the two endpoints to read the
traffic unencrypted. The main threat from this vulnerability is to data
confidentiality. (CVE-2020-1749)

Impact

This may allow anyone in between the two endpoints of the tunnel to read the
traffic unencrypted. The main threat from this vulnerability is to data
confidentiality.

Security Advisory Status

F5 Product Development has assigned ID SDC-1086 (Traffix) to this
vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases, point releases, or
hotfixes that address the vulnerability, refer to the following table. For more
information about security advisory versioning, refer to K51812227:
Understanding security advisory versioning.

Note: After a fix is introduced for a given minor branch, that fix applies to
all subsequent maintenance and point releases for that branch, and no
additional fixes for that branch will be listed in the table. For example, when
a fix is introduced in 14.1.2.3, the fix also applies to 14.1.2.4, and all
later 14.1.x releases (14.1.3.x., 14.1.4.x). For more information, refer to
K51812227: Understanding security advisory versioning. Additionally, software
versions preceding those listed in the following table have reached the End of
Technical Support (EoTS) phase of their lifecycle and are no longer evaluated
for security issues. For more information, refer to the Security hotfixes
section of K4602: Overview of the F5 security vulnerability response policy.

+————+——+————–+———-+———-+——+————-+
| | |Versions known|Fixes | |CVSSv3|Vulnerable |
|Product |Branch|to be |introduced|Severity |score^|component or |
| | |vulnerable^1 |in | |2 |feature |
+————+——+————–+———-+———-+——+————-+
| |16.x |None |Not | | | |
| | | |applicable| | | |
| +——+————–+———-+ | | |
| |15.x |None |Not | | | |
| | | |applicable| | | |
| +——+————–+———-+ | | |
| |14.x |None |Not | | | |
|BIG-IP (all | | |applicable|Not | | |
|modules) +——+————–+———-+vulnerable|None |None |
| |13.x |None |Not | | | |
| | | |applicable| | | |
| +——+————–+———-+ | | |
| |12.x |None |Not | | | |
| | | |applicable| | | |
| +——+————–+———-+ | | |
| |11.x |None |Not | | | |
| | | |applicable| | | |
+————+——+————–+———-+———-+——+————-+
| |8.x |None |Not | | | |
| | | |applicable| | | |
|BIG-IQ +——+————–+———-+ | | |
|Centralized |7.x |None |Not |Not |None |None |
|Management | | |applicable|vulnerable| | |
| +——+————–+———-+ | | |
| |6.x |None |Not | | | |
| | | |applicable| | | |
+————+——+————–+———-+———-+——+————-+
|F5OS |1.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+————+——+————–+———-+———-+——+————-+
|Traffix SDC |5.x |5.1.0 |None |High |7.5 |Linux kernel |
+————+——+————–+———-+———-+——+————-+

^1F5 evaluates only software versions that have not yet reached the End of
Technical Support (EoTS) phase of their lifecycle.

^2The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by installing a version listed in
the Fixes introduced in column. If the Fixes introduced in column does not list
a version for your branch, then no update candidate currently exists for that
branch and F5 recommends upgrading to a version with the fix (refer to the
table).

If the Fixes introduced in column lists a version prior to the one you are
running, in the same branch, then your version should have the fix.

Mitigation

None

Supplemental Information

o K41942608: Overview of security advisory articles
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K8986: F5 software lifecycle policy
o K9502: BIG-IP hotfix and point release matrix
o K13123: Managing BIG-IP product hotfixes (11.x – 16.x)
o K167: Downloading software and firmware from F5
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYJmpZ+NLKJtyKPYoAQgUVw/6AoCk9Haif2MdhZw1U43+Yku2Io+uMeDo
+2ZOR0wdWvO79jjfaGAcX2DnnTSKQTPHgEjJt/9xUcL/59DIITUgGeL5RNmvYLzb
pz7jy1YGyvWEDKLd1ZdMMD5yg60XltlqfZBvbWUUp2X4JuF0zOkmHc4x9oOopquq
HY+WpnDpEa1Ab1fJ1cf3u5brIsAyZvr8U9n7kThYaVTiLDIzOPCleZPD2dxQAy9I
gN+jpLlrTeu0dpQvkBHtqXNm3NFXJhj6gVSx0JefoAtvVSlAWm5qkKaoULBR6McH
Qgq/wWiBlBFdEbTvW/Oj2ZrFfbJMrT2xs647dT6pBYuUaGudOIoFMHiHoK4E3tAy
XuNWaNiGivrqLwiopNc4aX3P1bIqgI1wSGukuVvosZ5KgbhQ+nlYaOkdjeF+9AGb
d2cnrwopgNjuIMo/4kLKRycFMkoNhTt6LrITUMXR+M+4eLWobU2IT8sFmiei3f3j
+/l6bp+IsxM1k+9BvHRBBxN15gqRXc93iKOls1rXXALASCe3hESunZuDnnNipqHI
hfSwGoymSUHyoWlbY0HPA5MHeJU1k7nk6ekYDYXwq89S+WIQ8G/pvw5LHopALIU9
9DJKDLoEeBWw+Hs/9p/Sk0lzLGSQjpXHIylXJ8nDRdKZREWmLqrlwdbJl2JXfsrs
Jpnniq7/L70=
=VDi9
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.1581 – [Appliance] Traffix SDC: Access confidential data – Remote/unauthenticated appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/esb-2021-1581-appliance-traffix-sdc-access-confidential-data-remote-unauthenticated/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1581-appliance-traffix-sdc-access-confidential-data-remote-unauthenticated

ESB-2021.1582 – [Ubuntu] WebKitGTK: Multiple vulnerabilities

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.1582
USN-4939-1: WebKitGTK vulnerabilities
11 May 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: WebKitGTK
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Execute Arbitrary Code/Commands — Remote/Unauthenticated
Denial of Service — Remote/Unauthenticated
Cross-site Scripting — Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2021-1871 CVE-2021-1844 CVE-2021-1788

Reference: ESB-2021.1566
ESB-2021.1486
ESB-2021.1420
ESB-2021.0827

Original Bulletin:
https://ubuntu.com/security/notices/USN-4939-1

– ————————–BEGIN INCLUDED TEXT——————–

USN-4939-1: WebKitGTK vulnerabilities
10 May 2021

Several security issues were fixed in WebKitGTK.
Releases

o Ubuntu 20.10
o Ubuntu 20.04 LTS
o Ubuntu 18.04 LTS

Packages

o webkit2gtk – Web content engine library for GTK+

Details

A large number of security issues were discovered in the WebKitGTK Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.

Update instructions

The problem can be corrected by updating your system to the following package
versions:

Ubuntu 20.10

o libwebkit2gtk-4.0-37 – 2.32.0-0ubuntu0.20.10.1
o libjavascriptcoregtk-4.0-18 – 2.32.0-0ubuntu0.20.10.1

Ubuntu 20.04

o libwebkit2gtk-4.0-37 – 2.32.0-0ubuntu0.20.04.1
o libjavascriptcoregtk-4.0-18 – 2.32.0-0ubuntu0.20.04.1

Ubuntu 18.04

o libwebkit2gtk-4.0-37 – 2.32.0-0ubuntu0.18.04.1
o libjavascriptcoregtk-4.0-18 – 2.32.0-0ubuntu0.18.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.

References

o CVE-2021-1871
o CVE-2021-1844
o CVE-2021-1788

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYJmrpeNLKJtyKPYoAQjLIQ//WHtE8VH3yZbkDIIKRazzYORjUq3lZ/vq
gUn8LaMfNh497ijC1QT/skTwjKchxYkv3Xhzg1thfW5E3b985F+TXTxyMS4/Rmv9
9zFcYlxO6kA1wzx3Jyq9v+rLM8HPxzMFH8BtCDgHVJnQSdU/vl7s22RScvsRJRr/
LXtmqNoXvQpL1U5zbHw6SB83Smktmxex01V0YfJSLgWjHMTunxoKMkisGv8WaL3D
uffq8sftk/dI1692GifEUq3hBD/XKqofmKk23F4BXsyvpXJ5iJ22PcGQfk0jFDNQ
Ysi1gmOrZNN42JWPheqFL3uAT6K4bmQ7Mb3f6vFK46XzWTdKHgZ5YGJpNvROof6g
UIuXg/SAy1fsPAU8keMNWxC2229FdVFUJXdDqGMCFX5aXiXMLIE8PHa5rA6dWP+t
FiRLe8+7iORcMUpWBPCwe/EUgYExyynxFUlsnGD4NeVE1rbehs+mTG/SircBehx3
dhQ61Vi/rLnZ/7iubpt6JifXQlL3nsvSEj0175Mpa3dCjTq5hjslP5frnQk2O8xE
CX5pdf04FMryCKVIs2qbAHggtD3aUcL94x9q8G5CJvf4rOMHqLflrmMcaTx2R21g
VixzIRZGCk9N0UOC9pLGP84bMxay1fM7/ickps5VDnVv7Dq39xHKT7hLx8ihoLXs
7ZJ5tgjZnCA=
=po7d
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.1582 – [Ubuntu] WebKitGTK: Multiple vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/esb-2021-1582-ubuntu-webkitgtk-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1582-ubuntu-webkitgtk-multiple-vulnerabilities

ESB-2021.1583 – [Win][UNIX/Linux] Squid: Denial of service – Remote/unauthenticated

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.1583
Squid security update
11 May 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: Squid
Publisher: Squid
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Denial of Service — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-31808 CVE-2021-31807 CVE-2021-31806
CVE-2021-28662 CVE-2021-28652 CVE-2021-28651

Original Bulletin:
http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000129.html
http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000130.html
http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000131.html
http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000132.html
http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000133.html

Comment: This bulletin contains five (5) Squid security advisories.

This advisory references vulnerabilities in products which run on
platforms other than Squid. It is recommended that administrators
running Squid check for an updated version of the software for their
operating system.

– ————————–BEGIN INCLUDED TEXT——————–

Squid Proxy Cache Security Update Advisory SQUID-2021:1
__________________________________________________________________

Advisory ID: | SQUID-2021:1
Date: | May 10, 2021
Summary: | Denial of Service in URN processing
Affected versions: | Squid 2.0 -> 4.14
| Squid 5.x -> 5.0.5
Fixed in version: | Squid 4.15 and 5.0.6
__________________________________________________________________

__________________________________________________________________

Problem Description:

Due to a buffer management bug Squid is vulnerable to a
Denial of service attack against the server it is operating on.

This attack is limited to proxies which attempt to resolve a
“urn:” resource identifier. Support for this resolving is enabled
by default in all Squid.

__________________________________________________________________

Severity:

This problem allows a malicious server in collaboration with a
trusted client to consume arbitrarily large amounts of memory
on the server running Squid.

Lack of available memory resources impacts all services on the
machine running Squid. Once initiated the DoS situation will
persist until Squid is shutdown.

CVSS Score of 8.5

__________________________________________________________________

Updated Packages:

This bug is fixed by Squid versions 4.15 and 5.0.6.

In addition, patches addressing this problem for the stable
releases can be found in our patch archives:

Squid 4:

If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.

__________________________________________________________________

Determining if your version is vulnerable:

Squid older than 3.5.28 have not been tested and should be
assumed to be vulnerable.

All Squid-4.x up to and including 4.14 are vulnerable.

All Squid-5.x up to and including 5.0.5 are vulnerable.

__________________________________________________________________

Workaround:

Disable URN processing by the proxy. Add these lines to
squid.conf:

acl URN proto URN
http_access deny URN

__________________________________________________________________

Contact details for the Squid project:

For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.

If you install and build Squid from the original Squid sources
then the mailing list is your
primary support point. For subscription details see
.

For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
.

For reporting of security sensitive bugs send an email to the
mailing list. It’s a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

This vulnerability was discovered by Joshua Rogers of Opera
Software.

Fixed by Amos Jeffries of Treehouse Networks Ltd.

__________________________________________________________________

Revision history:

2021-02-22 06:55:38 UTC Initial Report
2021-02-24 00:53:21 UTC Patch Released
2021-03-17 06:19:09 UTC CVE Assignment

– ——————————————————————————–

Squid Proxy Cache Security Update Advisory SQUID-2021:2
__________________________________________________________________

Advisory ID: | SQUID-2021:2
Date: | May 10, 2021
Summary: | Denial of Service in HTTP Response Processing
Affected versions: | Squid 4.x -> 4.14
| Squid 5.x -> 5.0.5
Fixed in version: | Squid 4.15, 5.0.6
__________________________________________________________________

__________________________________________________________________

Problem Description:

Due to an input validation bug Squid is vulnerable to a Denial
of Service against all clients using the proxy.

__________________________________________________________________

Severity:

This problem allows a remote server to perform Denial of Service
when delivering HTTP Response messages. The issue trigger is a
header which can be expected to exist in HTTP traffic without any
malicious intent by the server.

CVSS Score of 7.9

__________________________________________________________________

Updated Packages:

This bug is fixed by Squid versions 4.15 and 5.0.6.

In addition, patches addressing this problem for the stable
releases can be found in our patch archives:

Squid 4:

If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.

__________________________________________________________________

Determining if your version is vulnerable:

All Squid older than 4.0 are not vulnerable.

All Squid-4.x up to and including 4.14 are vulnerable.

All Squid-5.x up to and including 5.0.5 are vulnerable.

__________________________________________________________________

Workaround:

There are no known workarounds for this vulnerability.

__________________________________________________________________

Contact details for the Squid project:

For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.

If you install and build Squid from the original Squid sources
then the mailing list is your
primary support point. For subscription details see
.

For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
.

For reporting of security sensitive bugs send an email to the
mailing list. It’s a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

This vulnerability was discovered by Joshua Rogers of Opera
Software.

Fixed by Alex Rousskov of The Measurement Factory.

__________________________________________________________________

Revision history:

2021-03-08 19:45:14 UTC Initial Report
2021-03-16 15:45:11 UTC Patch Released
2021-03-18 01:33:50 UTC CVE Allocation

– ——————————————————————————–

Squid Proxy Cache Security Update Advisory SQUID-2021:4
__________________________________________________________________

Advisory ID: | SQUID-2021:4
Date: | May 10, 2021
Summary: | Multiple issues in HTTP Range header
Affected versions: | Squid 2.5 -> 2.7.STABLE9
| Squid 3.x -> 3.5.28
| Squid 4.x -> 4.14
| Squid 5.x -> 5.0.5
Fixed in version: | Squid 4.16, 5.0.6
__________________________________________________________________

__________________________________________________________________

Problem Description:

Due to an incorrect input validation bug Squid is vulnerable to
a Denial of Service attack against all clients using the proxy.

Due to an incorrect memory management bug Squid is vulnerable to
a Denial of Service attack against all clients using the proxy.

Due to an integer overflow bug Squid is vulnerable to a Denial
of Service attack against all clients using the proxy.

__________________________________________________________________

Severity:

These problems all allow a trusted client to perform Denial of
Service when making HTTP Range requests.

The integer overflow problem allows a remote server to perform
Denial of Service when delivering responses to HTTP Range
requests. The issue trigger is a header which can be expected to
exist in HTTP traffic without any malicious intent.

CVSS Score of 8.0

__________________________________________________________________

Updated Packages:

This bug is fixed by Squid versions 4.15 and 5.0.6.

In addition, patches addressing this problem for the stable
releases can be found in our patch archives:

Squid 4:

Squid 5:

If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.

__________________________________________________________________

Determining if your version is vulnerable:

Squid older than 3.5.28 have not been tested and should be
assumed to be vulnerable.

All Squid-4.x up to and including 4.14 are vulnerable.

All Squid-5.x up to and including 5.0.5 are vulnerable.

__________________________________________________________________

Workaround:

There are no workarounds known for these problems.

__________________________________________________________________

Contact details for the Squid project:

For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.

If you install and build Squid from the original Squid sources
then the mailing list is your
primary support point. For subscription details see
.

For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
.

For reporting of security sensitive bugs send an email to the
mailing list. It’s a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

This vulnerability was discovered by Joshua Rogers of Opera
Software.

Fixed by Alex Rousskov of The Measurement Factory.

__________________________________________________________________

Revision history:

2021-03-19 06:49:52 UTC Initial Report of Denial of Service
2021-03-24 08:51:08 UTC Additional Report of Use-After-Free
2021-03-25 21:57:07 UTC Additional Report of integer-overflow

– ——————————————————————————–

Squid Proxy Cache Security Update Advisory SQUID-2021:3
__________________________________________________________________

Advisory ID: | SQUID-2021:3
Date: | May 10, 2021
Summary: | Denial of Service issue in Cache Manager
Affected versions: | Squid 1.x -> 3.5.28
| Squid 4.x -> 4.14
| Squid 5.x -> 5.0.4
Fixed in version: | Squid 4.15 and 5.0.5
__________________________________________________________________

__________________________________________________________________

Problem Description:

Due to an incorrect parser validation bug Squid is vulnerable to
a Denial of Service attack against the Cache Manager API.

__________________________________________________________________

Severity:

This problem allows a trusted client to trigger memory leaks
which over time lead to a Denial of Service against Squid and
the machine it is operating on.

This attack is limited to clients with Cache Manager API access
privilege.

CVSS Score of 7.8
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:F/RL:O/RC:C/CR:X/IR:X/AR:H/MAV:N/MAC:H/MPR:H/MUI:N/MS:C/MC:X/MI:X/MA:H&version=3.1

__________________________________________________________________

Updated Packages:

This bug is fixed by Squid versions 4.15 and 5.0.6.

In addition, patches addressing this problem for the stable
releases can be found in our patch archives:

Squid 4:

Squid 5:

If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.

__________________________________________________________________

Determining if your version is vulnerable:

Squid older than 3.5.28 have not been tested and should be
assumed to be vulnerable.

All Squid-4.x up to and including 4.14 are vulnerable.

All Squid-5.x up to and including 5.0.4 are vulnerable.

__________________________________________________________________

Workaround:

Either,

Disable Cache Manager access entirely if not needed.

Place the following line in squid.conf before lines containing
“allow” :

http_access deny manager

Or,

Harden Cache Manager access privileges.

For example; require authentication or other access controls in
http_access beyond the default IP address restriction.

__________________________________________________________________

Contact details for the Squid project:

For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.

If you install and build Squid from the original Squid sources
then the mailing list is your
primary support point. For subscription details see
.

For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
.

For reporting of security sensitive bugs send an email to the
mailing list. It’s a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

This vulnerability was discovered by Joshua Rogers of Opera
Software.

Fixed by Amos Jeffries of Treehouse Networks Ltd.

__________________________________________________________________

Revision history:

2021-03-03 17:02:25 UTC Initial Report
2021-03-16 01:59:45 UTC Patch Released
2021-03-17 06:19:09 UTC CVE Assignment

– ——————————————————————————–

Squid Proxy Cache Security Update Advisory SQUID-2021:5
__________________________________________________________________

Advisory ID: | SQUID-2021:5
Date: | May 10, 2021
Summary: | Denial of Service in HTTP Response Processing
Affected versions: | Squid 2.x -> 2.7.STABLE9
| Squid 3.x -> 3.5.28
| Squid 4.x -> 4.14
| Squid 5.x -> 5.0.5
Fixed in version: | Squid 4.15, 5.0.6
__________________________________________________________________

__________________________________________________________________

Problem Description:

Due to an input validation bug Squid is vulnerable to a Denial
of Service against all clients using the proxy.

__________________________________________________________________

Severity:

This problem allows a remote server to perform Denial of Service
when delivering HTTP Response messages. The issue trigger is a
header which can be expected to exist in HTTP traffic without
any malicious intent by the server.

CVSS Score of 8.8

__________________________________________________________________

Updated Packages:

This bug is fixed by Squid versions 4.15 and 5.0.6.

In addition, patches addressing this problem for the stable
releases can be found in our patch archives:

Squid 4:

Squid 5:

If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.

__________________________________________________________________

Determining if your version is vulnerable:

Squid older than 4.15 have not been tested and should be
assumed to be vulnerable.

All Squid-5.x up to and including 5.0.5 are vulnerable.

__________________________________________________________________

Workaround:

There are no known workarounds to this issue.

__________________________________________________________________

Contact details for the Squid project:

For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.

If you install and build Squid from the original Squid sources
then the mailing list is your
primary support point. For subscription details see
.

For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
.

For reporting of security sensitive bugs send an email to the
mailing list. It’s a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

This vulnerability was discovered by Joshua Rogers of Opera
Software.

Fixed by Alex Rousskov of The Measurement Factory.

__________________________________________________________________

Revision history:

2021-03-05 22:11:43 UTC Initial Report

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYJmt+ONLKJtyKPYoAQhY7g/9HPBaht6GBO4yj2wPTYcN2D10E3yV+t1t
WdebcxmYWKCAm3QCWGeLniWOyjB4zUhHv3WJNKjDdsPbXhsxDnonpByKAGzm3ATq
2CxkOdFjhmp9rA6U7cku2DCXlgpZrqAKpINhfZR/J8ycL8Um2PJcIB8U+4kTkEZc
LSE+Iga4xqpIzp+cvfW9PAH0h13vYJX3uGbFVOIZyd0gPr7D1RwQ2t5tIaatvgJA
hKmVsWaBT9k6LzofoKaa11PZzLd1tHkAHwvwKQSwprZxHMGs16OASpUpBY+hfs0Y
ThtPnY0Xp4E4VarucbRYrZV1CCYKGw6eIsc6gRdtX0MrZnWRytzFCB/ipNlI43LY
nbqmI/LLGyZY+epQHmM4btkmAvTYWly+AXlI6HsyQwQSgAYXa6e/PrIz5Pxrtq+7
eAaeaWY3nwyRHXf0C8RFY4HfT2plMEEtEMfJdLAisOnhphqTHzvuu7x6WzuS+CwH
CTe2cu4E2gP/UInGI3ekTJp1xJJPn2sGMsHyiW/6FzHdm5SGBeiAqcTbJirrM7NO
By3FEBfr7yECm/hHT36YkUHkfitNZicC56WBAasR9PfnYihCA0/TfQPdMBhB4AZZ
msYcijSOuMe254IuAvF31zuJL3YIDX7zqoWQy8DrOTgl0No69m2v0kQp6cjJR7Wq
5rojNhVG7/M=
=MdNu
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.1583 – [Win][UNIX/Linux] Squid: Denial of service – Remote/unauthenticated appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/esb-2021-1583-winunix-linux-squid-denial-of-service-remote-unauthenticated/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1583-winunix-linux-squid-denial-of-service-remote-unauthenticated

Network Security News Summary for Tuesday May 11st, 2021

Validating IP Addresses; Jailbreaking AirTags; Malicious Tor Exit Nodes

Validating IP Addresses: Why Encoding Matters
https://isc.sans.edu/forums/diary/Correctly+Validating+IP+Addresses+Why+encoding+matters+for+input+validation/27404/

Jail Breaking AirTags

Yesss!!! After hours of trying (and bricking 2 AirTags) I managed to break into the microcontroller of the AirTag!

/cc @colinoflynn @LennertWo pic.twitter.com/zGALc2S2Ph

— stacksmashing (@ghidraninja) May 8, 2021

Malicious Tor Exit Relay Activities
https://nusenu.medium.com/tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df

keywords: tor; exit nodes; nusenu; airtags; jailbreak; ip addresses; input validation

The post Network Security News Summary for Tuesday May 11st, 2021 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/network-security-news-summary-for-tuesday-may-11st-2021/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-tuesday-may-11st-2021

Colonial Pipeline Cyberattack: What Security Pros Need to Know

As the massive US pipeline operator works to restore operations after a DarkSide ransomware attack late last week, experts say it’s a cautionary tale for critical infrastructure providers.

The post Colonial Pipeline Cyberattack: What Security Pros Need to Know appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/colonial-pipeline-cyberattack-what-security-pros-need-to-know-3/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-cyberattack-what-security-pros-need-to-know-3

Colonial Pipeline Cyberattack: What Security Pros Need to Know

As the massive US pipeline operator works to restore operations after a DarkSide ransomware attack late last week, experts say it’s a cautionary tale for critical infrastructure providers.

The post Colonial Pipeline Cyberattack: What Security Pros Need to Know appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/colonial-pipeline-cyberattack-what-security-pros-need-to-know-2/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-cyberattack-what-security-pros-need-to-know-2

How a DDoS Attack on an Internet Service Provider Can Paralyze Critical Infrastructure

The motivation behind Distributed Denial of Service (DDoS) attacks is often unknown. In some cases it might be cyber-vandalism, causing disruption for disruption’s sake. In other cases it might be down to hactivism, reaction to a cause or an event. And while DDoS attacks on business enterprises can result in huge commercial losses due to […]

The post How a DDoS Attack on an Internet Service Provider Can Paralyze Critical Infrastructure appeared first on Blog.

The post How a DDoS Attack on an Internet Service Provider Can Paralyze Critical Infrastructure appeared first on Security Boulevard.

Read More

The post How a DDoS Attack on an Internet Service Provider Can Paralyze Critical Infrastructure appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/how-a-ddos-attack-on-an-internet-service-provider-can-paralyze-critical-infrastructure/?utm_source=rss&utm_medium=rss&utm_campaign=how-a-ddos-attack-on-an-internet-service-provider-can-paralyze-critical-infrastructure

Imperva® Opens the first dedicated DDoS scrubbing center in Santiago, Chile

Imperva is excited to be further expanding our presence in Latin America by launching a new Point of Presence (PoP) in Santiago, Chile, in partnership with leading Chilean Telecommunications provider Entel Corporations. Located within Entel’s gold-standard Ciudad de Los Valles datacenter, which has been awarded the highest global certification for operational sustainability, Imperva is well […]

The post Imperva® Opens the first dedicated DDoS scrubbing center in Santiago, Chile appeared first on Blog.

The post Imperva® Opens the first dedicated DDoS scrubbing center in Santiago, Chile appeared first on Security Boulevard.

Read More

The post Imperva® Opens the first dedicated DDoS scrubbing center in Santiago, Chile appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/imperva-opens-the-first-dedicated-ddos-scrubbing-center-in-santiago-chile/?utm_source=rss&utm_medium=rss&utm_campaign=imperva-opens-the-first-dedicated-ddos-scrubbing-center-in-santiago-chile

Protecting Cloud Data Throughout Its Lifecycle

Organizations have flocked from on-premises to the cloud over the past year, and protecting data during the transition has proven to be a monumental task. But now companies must focus on what happens after the migration. The new reality is that these organizations and their cloud providers work under a shared responsibility model, in which…

The post Protecting Cloud Data Throughout Its Lifecycle appeared first on Baffle.

The post Protecting Cloud Data Throughout Its Lifecycle appeared first on Security Boulevard.

Read More

The post Protecting Cloud Data Throughout Its Lifecycle appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/protecting-cloud-data-throughout-its-lifecycle/?utm_source=rss&utm_medium=rss&utm_campaign=protecting-cloud-data-throughout-its-lifecycle

Las prioridades de seguridad y gestión de riesgos de TI para 2021 según Gartner

Los líderes en seguridad y gestión de riesgos desempeñan un rol clave en los negocios digitales y son responsables de ayudar a la empresa a equilibrar los riesgos y beneficios asociados. ¿Cuáles deben ser sus prioridades en 2021?

La creación …

The post Las prioridades de seguridad y gestión de riesgos de TI para 2021 según Gartner appeared first on ManageEngine Blog.

The post Las prioridades de seguridad y gestión de riesgos de TI para 2021 según Gartner appeared first on Security Boulevard.

Read More

The post Las prioridades de seguridad y gestión de riesgos de TI para 2021 según Gartner appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/las-prioridades-de-seguridad-y-gestion-de-riesgos-de-ti-para-2021-segun-gartner/?utm_source=rss&utm_medium=rss&utm_campaign=las-prioridades-de-seguridad-y-gestion-de-riesgos-de-ti-para-2021-segun-gartner

Wyner wiretap-like encoding scheme for cyber-physical systems

Read More

The post Wyner wiretap-like encoding scheme for cyber-physical systems appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/wyner-wiretap-like-encoding-scheme-for-cyber-physical-systems/?utm_source=rss&utm_medium=rss&utm_campaign=wyner-wiretap-like-encoding-scheme-for-cyber-physical-systems

Improving Cost Learning for JPEG Steganography by Exploiting JPEG Domain Knowledge

Read More

The post Improving Cost Learning for JPEG Steganography by Exploiting JPEG Domain Knowledge appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/improving-cost-learning-for-jpeg-steganography-by-exploiting-jpeg-domain-knowledge/?utm_source=rss&utm_medium=rss&utm_campaign=improving-cost-learning-for-jpeg-steganography-by-exploiting-jpeg-domain-knowledge

Colonial Pipeline Cyberattack: What Security Pros Need to Know

As the massive US pipeline operator works to restore operations after a DarkSide ransomware attack late last week, experts say it’s a cautionary tale for critical infrastructure providers.

The post Colonial Pipeline Cyberattack: What Security Pros Need to Know appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/colonial-pipeline-cyberattack-what-security-pros-need-to-know/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-cyberattack-what-security-pros-need-to-know

Tulsa Deals With Aftermath of Ransomware Attack

Weekend attack shuts down several city sites and service.

The post Tulsa Deals With Aftermath of Ransomware Attack appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/tulsa-deals-with-aftermath-of-ransomware-attack/?utm_source=rss&utm_medium=rss&utm_campaign=tulsa-deals-with-aftermath-of-ransomware-attack

Four Plead Guilty to RICO Conspiracy Involving Hosting Services for Cybercrime

The “bulletproof hosting” organization hosted malware including Zeus, SpyEye, Citadel, and the Blackhole Exploit Kit.

The post Four Plead Guilty to RICO Conspiracy Involving Hosting Services for Cybercrime appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/four-plead-guilty-to-rico-conspiracy-involving-hosting-services-for-cybercrime/?utm_source=rss&utm_medium=rss&utm_campaign=four-plead-guilty-to-rico-conspiracy-involving-hosting-services-for-cybercrime

6 Ways to Engage, 5 Key Qualities of CISOs, & 4 Actions Leader Take – BSW #216

In the Leadership and Communications section, 6 ways to spur cybersecurity board engagement, 5 key qualities of successful CISOs, and how to develop them, 4 Actions Transformational Leaders Take, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw216

The post 6 Ways to Engage, 5 Key Qualities of CISOs, & 4 Actions Leader Take – BSW #216 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/6-ways-to-engage-5-key-qualities-of-cisos-4-actions-leader-take-bsw-216/?utm_source=rss&utm_medium=rss&utm_campaign=6-ways-to-engage-5-key-qualities-of-cisos-4-actions-leader-take-bsw-216

The Lost Year: The Impact of the Pandemic on Web App Security – Ryan Bergquist – BSW #216

The shift away from web application security, caused by the pandemic and the focus on remote workforces, resulted in an increased number of web vulnerabilities, as shown in the latest Acunetix by Invicti Web Application Vulnerability Report. In this segment, Ryan will discuss the main results, the trends that might have caused them, and advise how you can protect your organization against vulnerabillties that can negatively impact your business.

Segment Resources:
The Invicti AppSec Indicator, Spring 2021 Edition: Acunetix Web Vulnerability Report
https://www.acunetix.com/white-papers/acunetix-web-application-vulnerability-report-2021/

This segment is sponsored by Netsparker.

Visit https://securityweekly.com/netsparker to learn more about them!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw216

The post The Lost Year: The Impact of the Pandemic on Web App Security – Ryan Bergquist – BSW #216 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/10/the-lost-year-the-impact-of-the-pandemic-on-web-app-security-ryan-bergquist-bsw-216/?utm_source=rss&utm_medium=rss&utm_campaign=the-lost-year-the-impact-of-the-pandemic-on-web-app-security-ryan-bergquist-bsw-216