Last Week’s Top Threats and Trends in Cybersecurity from the THN Recap (September 23-29)

Sep 30, 2024Ravie LakshmananCybersecurity / Weekly Recap

Get ready for some exciting updates in the realm of cybersecurity! The past week brought some alarming revelations, unveiling vulnerabilities in CUPS that could have paved the way for remote attacks. Meanwhile, Google’s transition to Rust is yielding positive results, significantly reducing memory-related vulnerabilities in Android.

However, not all the news was positive – the abrupt departure of Kaspersky from the US market left users grappling with uncertainties. And the discovery of potential vulnerabilities in Kia cars, which could have been exploited using just a license plate, added to the unsettling developments.

Let’s delve into these accounts and equip ourselves with the necessary insights to navigate the ever-changing digital terrain safely.

⚡ Top Threat This Week

CUPS Vulnerabilities: A fresh batch of security flaws has surfaced in the OpenPrinting Common Unix Printing System (CUPS) on Linux platforms, potentially enabling remote command execution under specific circumstances. Red Hat Enterprise Linux has categorized these issues as significant, although the practical impact is anticipated to be minimal due to the prerequisites required to carry out a successful attack.

🔔 Key Developments

• Google Embraces Rust: Google’s shift towards employing secure memory-safe languages like Rust for Android has led to a remarkable drop in the discovery of memory-related vulnerabilities in the platform, plummeting from 76% to 24% within a six-year span. This strategic move, coupled with enhanced collaboration between Google and Arm, has enabled the identification of multiple deficiencies, bolstering the overall security of the GPU software/firmware ecosystem in Android devices.
• Kaspersky’s US Exit: Kaspersky, the Russian cybersecurity provider barred from selling its products in the US due to national security reasons, stirred controversy following reports of automatic removals of installations from some users, replaced by antivirus software from a lesser-known entity named UltraAV. While Kaspersky had initiated the transition process earlier in the month, users were caught off guard by the forced migration without prior consent on their part. Pango, the parent company of UltraAV, stated that users had the option to terminate their subscription through direct engagement with Kaspersky’s customer support team.
• Kia Cars Vulnerabilities: An array of now rectified vulnerabilities in Kia vehicles surfaced, potentially permitting remote manipulation of critical functions solely based on the exploitation of license plate data. These flaws could have also facilitated unauthorized access to sensitive information like the victim’s personal details, including name, contact information, and physical address. There is no evidence to suggest that these vulnerabilities were ever exploited in real-world scenarios.
• US Sanctions Cryptex and PM2BTC: The US government imposed sanctions on two cryptocurrency exchanges, Cryptex and PM2BTC, for reportedly aiding in the laundering of cryptocurrencies obtained via cybercrime activities. Concurrently, an indictment was unsealed against Sergey Sergeevich Ivanov, a Russian national accused of operating various money laundering services catering to cybercriminals.
• Charges Against Three Iranian Hackers: In a separate legal action, the US government levied charges against three Iranian individuals, Masoud Jalili, Seyyed Ali Aghamiri, and Yasar (Yaser) Balaghi, purportedly linked to the Islamic Revolutionary Guard Corps (IRGC), for orchestrating data theft campaigns targeting current and former officials to allegedly influence the upcoming elections. Iran has refuted the allegations, branding them as unfounded.

📰 Global Cyber Insights

• Insights into Mysterious Internet Noise Storms: GreyNoise, a threat intelligence firm, disclosed its tracking of extensive waves of “Noise Storms” involving spoofed internet traffic comprising TCP connections and ICMP packets since January 2020. Despite the lack of definitive origins and intentions behind the phenomenon, one intriguing aspect is the presence of an “LOVE” ASCII string within the generated ICMP packets, hinting at a potential covert communication channel. The influx of spoofed IPs inundating major internet providers exclude AWS, suggesting a sophisticated entity orchestrating the operation with a specific agenda. The traffic’s purported origin from Brazil, intertwined with references to Chinese platforms like QQ, WeChat, and WePay, hints at deliberate obfuscation, complicating efforts aimed at tracing the true motive and source.
• Tails and Tor Collaboration: The Tor Project, responsible for maintaining the Tor (The Onion Router) anonymity network, announced a collaboration with Tails (The Amnesic Incognito Live System), a producer of a portable Linux OS leveraging Tor technology. Integrating Tails into the Tor Project’s framework streamlines collaborative efforts, enhances sustainability, reduces overhead, and broadens training and outreach initiatives to counter a wider array of digital threats. The integration has been met with positive sentiment, with the Tails OS team lead describing it as a harmonious merger.
• NIST Proposes Fresh Password Guidelines: The US National Institute of Standards and Technology (NIST) has outlined new directives advising credential service providers (CSPs) to refrain from endorsing uniform password requirements, suggesting diverse approaches to strengthen security protocols.

Utilize various character types in passwords and eliminate the requirement for regular password changes unless the security token is compromised. Additional notable suggestions comprise having passwords ranging from 15 to 64 characters in length, and allowing the utilization of both ASCII and Unicode characters when creating them.

• PKfail Exceedingly Broad As Previously Understood: A critical issue in the firmware supply chain termed PKfail (CVE-2024-8105), enabling intruders to sidestep Secure Boot and insert malware, has currently been identified to impact a wider array of devices, including medical equipment, personal computers, laptops, gaming devices, business servers, ATMs, PoS terminals, and even voting systems. Binarly has depicted PKfail as a “prime illustration of a supply chain security breakdown influencing the entire sector.”
• Microsoft Restructures Recall: Following the launch of its AI-powered feature Recall in May 2024, Microsoft faced quick backlash due to concerns about privacy and security, as well as facilitating threat actors in pilfering sensitive details. Consequently, the corporation postponed a broader deployment pending adjustments to tackle the challenges. As part of the latest enhancements, Recall is no longer activated by default and can be removed by users. Furthermore, it transitions all screenshot processing to a Virtualization-based Security (VBS) Enclave. Additionally, the company enlisted an undisclosed third-party security provider to carry out an autonomous assessment of the security design and penetration test.