The SOS Intelligence CVE Chatter Weekly Top Ten – 25 July 2022

by Amir Hadzipasic

July 25, 2022

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2022-1139

Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

https://nvd.nist.gov/vuln/detail/CVE-2022-1139

2. CVE-2022-1137

Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to leak potentially sensitive information via a crafted HTML page.

https://nvd.nist.gov/vuln/detail/CVE-2022-1137

3. CVE-2022-1128

Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network segment to leak cross-origin data via a crafted HTML page.

https://nvd.nist.gov/vuln/detail/CVE-2022-1128

4. CVE-2012-2459

Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.6, 0.5.x before 0.5.5, 0.6.0.x before 0.6.0.7, and 0.6.x before 0.6.2 allows remote attackers to cause a denial of service (block-processing outage and incorrect block count) via unknown behavior on a Bitcoin network.

https://nvd.nist.gov/vuln/detail/CVE-2012-2459

5. CVE-2022-1146

Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

https://nvd.nist.gov/vuln/detail/CVE-2022-1146

6. CVE-2022-31162

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs.

https://nvd.nist.gov/vuln/detail/CVE-2022-31162

7. CVE-2018-17144

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.

https://nvd.nist.gov/vuln/detail/CVE-2018-17144

8. CVE-2020-14126

Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information.

https://nvd.nist.gov/vuln/detail/CVE-2020-14126

9. CVE-2017-8570

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka “Microsoft Office Remote Code Execution Vulnerability”. This CVE ID is unique from CVE-2017-0243.

https://nvd.nist.gov/vuln/detail/CVE-2017-8570

10. CVE-2022-23141

ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attacker could use this vulnerability to log in to the device to obtain sensitive information.

https://nvd.nist.gov/vuln/detail/CVE-2022-23141

CVE Top 10

The SOS Intelligence CVE Chatter Weekly Top Ten – 18 July 2022

by Amir Hadzipasic

July 18, 2022

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2012-2459

https://nvd.nist.gov/vuln/detail/CVE-2012-2459

2. CVE-2017-7479

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-7479

3. CVE-2015-1774

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2015-1774

4. CVE-2015-2684

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2015-2684

5. CVE-2013-7441

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2013-7441

6. CVE-2017-7508

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-7508

7. CVE-2017-7520

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-7520

8. CVE-2017-7521

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-7521

9. CVE-2015-3988

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2015-3988

10. CVE-2015-0847

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2015-0847

Opinion

What is Cyber Threat Intelligence?

by Ben Hurst

July 13, 2022

You may have heard of the term “Cyber Threat Intelligence”, sometimes abbreviated as “CTI”.

The term is often thrown around with little to no explanation, so, what actually is CTI? It’s always useful to know what an acronym means 🙂

The origin of the term can be traced back to 2009 in reference to research on the Tactics, Techniques, and Practices (TTP) of APT 1.

Traditional threat intelligence, meaning the collection and dissemination of intelligence of emerging and reoccurring threats, was a key part of the intelligence apparatus during the Cold War.

However, traditional threat intelligence is a very general term, referring to intelligence on anything from nation-states to small guerrilla insurgent groups.

The rise of Advanced Persistent Threats (APT) forever changed the threat intelligence landscape.

Like any other covert action, a nation-state sponsored cyber attack is designed to cause as much damage as possible, while maintaining plausible deniability for guilty parties.

Threat intelligence on these APT groups became known as Cyber Threat Intelligence.

CTI analysts analyse the tactics, techniques, and practices of these groups. They collect everything from the groups’ malware to their chat logs to build a full profile for defensive purposes.

Since the rise of APTs in the mid-2000s, the field of CTI has had to evolve and adapt to new threats and attack styles. Threat actors less sophisticated than APTs can now emulate many of the tactics APTs use.

As a result, CTI has had to expand to collect intelligence on these groups as well. CTI is now not only crucial for governments, but also private organisations and businesses.

2021 saw a 1,885% increase in ransomware attacks. This was an unprecedented increase with the healthcare industry alone reported a 775% increase in cyber attacks.

CTI is not only for large businesses either, roughly 60% of ransomware attacks target businesses with less than 500 employees. However, building a CTI team is easier said than done. Collecting intelligence on relevant threat actors is often a time consuming and expensive task.

What we see time and time again is the “it won’t happen to us” conversation which can then turn into…

Why didn’t we know about this?!

The question posed by the CEO or MD when there has been a data breach.

Here at SOS Intelligence, it’s our mission to provide cyber threat intelligence that won’t break the bank and is accessible. You don’t need a big team to use it.

Our Open Source Intelligence (OSINT) tool automatically collects and aggregates data from the top cybercriminal forums, including some private forums.

Using the web UI or the custom API, you can set alerts for keywords like emails or usernames. If a keyword is posted on one of the many forums we monitor, you will get an immediate alert via several communication channels.

Using our OSINT tool you will have the capabilities of a full CTI team, minus the overhead and head count.

Save yourself the headache and risk, let SOS Intelligence be your eyes and ears in the dark world cyber criminals have built online.

Cyber Threat Intelligence is clearly an essential pillar of a modern defence strategy, but don’t take our word for it. Let’s look into a case involving CTI…

LAPSUS$ – A Study of Cyber Threat Intelligence Successes

There is no better case study of modern Cyber Threat Intelligence than the case of the international hacking group known as LAPSUS$.

LAPSUS$ was first noticed in early December of 2021 when the group compromised systems belonging to the Brazilian Ministry of Health. This attack was a classic extortion attempt and would pale in comparison to LAPSUS$’s later attacks.

It took the Brazilian government more than a month to make a full recovery, the attack effectively halted the roll out of Brazil’s COVID-19 vaccine certification app; ConectSUS.

Over the next few months LAPSUS$ would go on to breach several more companies, including Impresa, a Portuguese media company and Vodafone Portugal. LAPSUS$’s first 5 attacks took place in quick succession, in just 3 months.

The group exclusively targeted Portuguese localised companies leading many CTI researchers to suspect the hackers were located in Brazil or Portugal. Members of the group solidified this suspicion, using slang like “kkkkkkkkk” the Portuguese equivalent of the English slang “hahaha”.

LAPSUS$ member using Portuguese slang in Telegram chat

LAPSUS$ was put on the map after the attack on the Brazilian Ministry of Health garnering headlines like “Lapsus$: The Hot New Name in Ransomware Gangs” and “Watch Out LockBit, Here Comes Lapsus$!”.

While these headlines were catchy, the articles themselves offered no insight into the tactics or motivations of the group. At the time, many thought LAPSUS$ was just like any other ransomware/extortion group, financially-motivated with the goal of encrypting or exfiltrating data and holding it for ransom.

However, LAPSUS$’s next attack would challenge everything we thought we knew about LAPSUS$. On February 25th 2022, GPU chipmaker Nvidia announced it was investigating an “incident” that knocked some of its systems offline for 2 days. 3 days later LAPSUS$ announced “We hacked NVIDIA” on their telegram…

LAPSUS$’s breach of Nvidia was, no doubt, a big deal, but what was far more interesting were their demands.

More often than not, hacking groups fall into one of 3 motivational categories: financially-motivated, ideologically-motivated, or state-sponsored. Up until the Nvidia breach LAPSUS$ fell squarely in the financially-motivated category, but their unusual demands for Nvidia changed this fact.

Instead of demanding money or selling the data to the highest bidder, LAPSUS$ demanded Nvidia release their GPU drivers as open source software. Naturally, Nvidia refused to release their code. In response LAPSUS$ would leak some source code from Nvidia on in their Telegram group, but nothing all that interesting or noteworthy.

Less than 2 weeks after the Nvidia breach, LAPSUS$ announced they had compromised Samsung. The attackers stole roughly 200 gigabytes of data which included some source code for the Samsung Galaxy.

By this point, threat intelligence researchers were keenly aware of LAPSUS$’s tactics, techniques and procedures. CTI analysts drew up models of how LAPSUS$ operates, giving defenders insight on how to avoid a possible breach.

Intrusion Analysis Diamond model for LAPSUS$

Continuing their attacks on large tech companies, LAPSUS$ compromised Microsoft. Again, the group started exfiltrating source code.

LAPSUS$ was able to download the partial source code for Bing, Bing Maps, and even some Windows code. However, Microsoft CTI researchers were able to halt the download before it could be completed. LAPSUS$ mentioned in a public Telegram chat how they were able to access Microsoft systems before the data exfiltration had finished.

Microsoft’s threat intelligence team had been monitoring this chat and was able to stop the exfiltration in real-time. That’s something even advanced EDR software can’t do. While LAPSUS$ would never admit their mistakes, one member did acknowledge the download was interrupted.

LAPSUS$ would soon after be exposed to be led by a teenage boy out of the United Kingdom who was arrested with six other teenagers associated with the group. Many still suspect there may have been a member located in Brazil, but as of now, this has not been confirmed.

The LAPSUS$ affair is an excellent showcase of how Cyber Threat Intelligence can protect your organisation from advanced and emerging threat actors.

The SOS Intelligence toolkit can provide you and your company the capability to monitor threats like LAPSUS$. Just as Microsoft leveraged CTI analysis to minimise damage of the LAPSUS$ attack, your organisation can use our CTI tools.

The SOS Intelligence toolkit includes advanced CTI tools capable of monitoring both Dark Web and Clear Web hacking forums and chats. Protect your assets from sophisticated threats today by checking out the SOS Intel toolkit.

Would you like to discover how SOS Intelligence can help you mitigate the cyber threats?

Click the link below to book a call: https://tinyurl.com/sosinteldemo

FAQ

What is Cyber Threat Intelligence?

Cyber Threat Intelligence or CTI, is the process of collecting and analysing threat actor’s behaviours. CTI analysts build profiles of known threat actors by investigating their Tactics Techniques and Procedures (TTPs).

How is Cyber Threat Intelligence used?

Network defenders use profiles as well as the TTPs collected by CTI analysts to make informed decisions on how to protect their network.

Threat actors will often reuse attack vectors on many targets. When CTI analysts discover these attack vectors, they pass on the information to defenders.

Cyber Threat Intelligence provides the defenders the ability to fight existing and emerging threat actors.

What is a CTI framework?

A Cyber Threat Intelligence framework is an organisational tool for CTI analysts. There are many CTI frameworks, one of the most popular being the MITRE ATT&CK framework.

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

Source: https://attack.mitre.org

Why is Cyber Threat Intelligence Important?

Much like a physical conflict, cyber conflicts need proactive intelligence for good defence.

Cyber criminals often use forums and chat rooms to communicate with each other. Infiltrating these groups can provide great insight into upcoming and ongoing cyber attacks.

With the shocking increase of ransomware attacks, proper threat intelligence has become imperative. Ransomware groups are tracked and monitored day and night by CTI analysts. Analysts then alert defenders to a possible breach or upcoming attack.

Who do cyber criminals target?

The cyber criminal atmosphere is constantly evolving, but most cyber criminals fall into one of three categories.

First, you have your typical financially-motivated cyber criminal. These threat actors are motivated by one thing and one thing only; money.

They will scam, hack, and steal anything or anyone for money. In fact, sometimes they scam other cyber criminals!

The second category is the ideologically-motivated threat actor. Often dubbed hacktivists, these cyber criminals care less about money and are motivated by a political cause. Prime examples of “hacktivist” style hacking groups are “AgainstTheWest” or “Anonymous”.

The third and most dangerous category is the state-sponsored threat actor. These threat actors work directly or indirectly for a nation-state.

State-backed threat actors have almost unlimited resources as well as legal protection provided by their government. CTI analysts classify these groups as Advanced Persistent Threats or APTs.

While not every APT group is state-backed, all state-backed groups are APTs. For cyber criminals, their motivation is the key behind who they target. Financially-motivated cyber criminals often target businesses both small and large.

Ideologically-motivated threat actors tend to target governments, institutions, or individuals who they deem political enemies. State-backed threats have very specific targets given to them by whatever nation-state they work for. These targets often control vital systems, i.e. energy companies or defence contractors.

Photo by Philipp Katzenberger on Unsplash

CVE Top 10

The SOS Intelligence CVE Chatter Weekly Top Ten – 11 July 2022

by Amir Hadzipasic

July 11, 2022

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2018-17144

https://nvd.nist.gov/vuln/detail/CVE-2018-17144

2. CVE-2012-2459

https://nvd.nist.gov/vuln/detail/CVE-2012-2459

3. CVE-2015-0847

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

https://nvd.nist.gov/vuln/detail/CVE-2015-0847

4. CVE-2015-1774

https://nvd.nist.gov/vuln/detail/CVE-2015-1774

5. CVE-2015-3988

https://nvd.nist.gov/vuln/detail/CVE-2015-3988

6. CVE-2017-7479

https://nvd.nist.gov/vuln/detail/CVE-2017-7479

7. CVE-2017-7508

https://nvd.nist.gov/vuln/detail/CVE-2017-7508

8. CVE-2015-2684

https://nvd.nist.gov/vuln/detail/CVE-2015-2684

9. CVE-2017-7521

https://nvd.nist.gov/vuln/detail/CVE-2017-7521

10. CVE-2013-7441

https://nvd.nist.gov/vuln/detail/CVE-2013-7441

CVE Top 10

The SOS Intelligence CVE Chatter Weekly Top Ten – 04 July 2022

by Amir Hadzipasic

July 4, 2022

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2018-17144

https://nvd.nist.gov/vuln/detail/CVE-2018-17144

2. CVE-2012-2459

https://nvd.nist.gov/vuln/detail/CVE-2012-2459

3. CVE-2017-7521

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-7521

4. CVE-2015-0847

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2015-0847

5. CVE-2015-1774

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2015-1774

6. CVE-2015-3988

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2015-3988

7. CVE-2017-8109

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-8109

8. CVE-2013-7441

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2013-7441

9. CVE-2017-7520

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-7520

10. CVE-2017-7508

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

https://nvd.nist.gov/vuln/detail/CVE-2017-7508

CVE Top 10

The SOS Intelligence CVE Chatter Weekly Top Ten – 27 June 2022

by Amir Hadzipasic

June 27, 2022

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2018-17144

https://nvd.nist.gov/vuln/detail/CVE-2018-17144

2. CVE-2012-2459

https://nvd.nist.gov/vuln/detail/CVE-2012-2459

3. CVE-2022-26134

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

https://nvd.nist.gov/vuln/detail/CVE-2022-26134

4. CVE-2017-7508

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7508

5. CVE-2017-7520

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7520

6. CVE-2017-7521

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7521

7. CVE-2017-7512

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7512

8. CVE-2016-6316

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2016-6316

9. CVE-2017-7522

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7522

10. CVE-2022-32969

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

https://nvd.nist.gov/vuln/detail/CVE-2022-32969

CVE Top 10

The SOS Intelligence CVE Chatter Weekly Top Ten – 20 June 2022

by Amir Hadzipasic

June 20, 2022

This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

There are thousands of vulnerability discussions each week. SOS Intelligence gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

1. CVE-2018-17144

https://nvd.nist.gov/vuln/detail/CVE-2018-17144

2. CVE-2012-2459

https://nvd.nist.gov/vuln/detail/CVE-2012-2459

3. CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

https://nvd.nist.gov/vuln/detail/CVE-2021-44228

4. CVE-2017-7521

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7521

5. CVE-2017-7508

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7508

6. CVE-2017-7520

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

https://nvd.nist.gov/vuln/detail/CVE-2017-7520

7. CVE-2022-26134

https://nvd.nist.gov/vuln/detail/CVE-2022-26134

8. CVE-2021-4034

A local privilege escalation vulnerability was found on polkit’s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn’t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it’ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

https://nvd.nist.gov/vuln/detail/CVE-2021-4034

9. CVE-2017-7479

https://nvd.nist.gov/vuln/detail/CVE-2017-7479

10. CVE-2017-8109

https://nvd.nist.gov/vuln/detail/CVE-2017-8109

Opinion

Why MSSPs need Cyber Intelligence from SOS Intelligence

by Amir Hadzipasic

June 16, 2022

The Dark Web is a vital source for Cyber Threat Intelligence. Dark Web networks have been utilised by cyber criminals for more than 20 years. Longer than you may think.

They provide a deep insight into the world of online criminals.

For MSSPs and CTI researchers this means the Dark web must be closely monitored for new and ongoing attacks.

Scouring the Dark Web is no easy task, and very difficult without proper software and a large team of researchers.

The Dark Web is a vast territory made up of multiple networks using many network protocols for anonymous communication.

The most used Dark Web network, known as The Onion Router or Tor, consists of more than 7,000 relays and 3,000 bridges. This supportsa hefty user base of roughly 3 million users. These users use Tor to access one or more of the 40,000 services on the Tor network, transmitting more than 20 terabytes of data daily.

So, the million dollar question is…

How does one index and analyse such a vast network in an affordable and time efficient manner?

This is where SOS Intelligence comes in. We help MSSPs help businesses and organisations sleep easier at night by providing accessible cyber-threat and dark web intelligence with real time alerting. It’s a highly configurable threat intelligence solution.

Our Dark Web toolkit is capable of indexing the Tor network quickly and efficiently.
The SOS Intel Dark Web toolkit is a “Turnkey” ready-to-go solution for MSSPs and CTI researchers, offering in-depth data on onion services.

Our toolkit includes the Tor networking mapping tool known as “DARKMAP” plus the Dark Web search tool “DARKSEARCH”. We also have the Open Source Intelligence tool “OSINT SEARCH”. These are accessed via a custom API and a web dashboard where you can manage your alerts and keywords for CTI.

We understand time limitations MSSPs and CTI researchers have. SOS Intelligence’s mission is to provide a service that is both affordable and accessible. Our entire Dark Web toolkit can be set up and configured in mere minutes!

We are your eyes and ears online, even in the darkest places.

Written by Ben Hurst.

Photo by Markus Spiske on Unsplash

CVE Top 10, Product news

Announcing The SOS Intelligence CVE Chatter Weekly Top Ten

by Amir Hadzipasic

June 16, 2022

Keeping track of the number of CVEs can be a daunting task. We’ve got something that is going to help…

We’ve developed a process which gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

Firstly, what is a CVE?

The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures. The system was launched for the public in September 1999.

The United States’ National Cybersecurity FFRDC, operated by The Mitre Corporation, maintains the system. They do this with funding from the US National Cyber Security Division of the US Department of Homeland Security.

What is a vulnerability?

A vulnerability is a weakness which can be used to access things one should not be able to gain access to. Obviously this is less than ideal! What would an attacker do? Well, they could run some malicious code or install malware. There could even be the option to copy useful data, or delete it.

What is an exposure?

An exposure is different. It’s a mistake made within the network or system, or code, that gives an intruder access to where they shouldn’t be.

Exposures are often mistakes. For example a GitHub repository which is open or an accessible Amazon S3 folder. These can be found accidentally and never become disclosed. What can happen is that they are found by the kind of people who you really don’t want snooping around.

CVE Identifiers give each one a different name, so people can talk about a specific vulnerability by using their name. At the time of writing, there are over 18800 CVEs listed!

So how are we going to help you keep track of CVEs?

We’ve developed a process which gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

This is via our unique intelligence collection pipelines, which include the Dark Web.

Every Monday, you’ll see a blog post appear with the latest CVEs which have been discussed the most over the previous 7 days. This is the first one from the 14th June.

If you use RSS (https://en.wikipedia.org/wiki/RSS), then add http://sosintel.co.uk/feed to your reader and you’ll see these automatically.

We make every effort to ensure the accuracy of the data presented. As this is an automated process some errors may creep in.

If you are feeling generous please do make us aware of anything you spot, feel free to follow us on Twitter @sosintel and DM us. Thank you!

We are your eyes and ears online, even in the darkest places.

Investigation

SOS Intelligence analysing Lapsus$ data and breaches

by Amir Hadzipasic

March 31, 2022

We’ve been tracking what Lapsus$ have been doing and we’ve been analysing the data from the latest breaches. Like most hacking collectives SOS Intelligence has been aware of and tracking the activity of the LAPSUS$ group for some time.

The group has contributed to some high profile and impact breaches in the last few months. They have been utilising what could be considered as fairly “low tech” methods to gain a foothold on their targets. Using our multi-faceted intelligence collection pipelines we are able to keep a track of the groups activities and announcements.

This time, the data included a large amount of GitHub source code that appears to belong to Globant, a major company with over 16000 employees and and $1.2 billion in revenue for 2021. This is with a number of repositories that contain “very sensitive information” such as TLS certificate private keys and chains, Azure keys and API keys for 3rd-party services.

TechCrunch have written about this and we were quoted on their article:

SOS Intelligence, a U.K-based threat intelligence provider that analyzed the leaked data, told TechCrunch that “the leak is legitimate and very significant, as far as Globant and Globant impacted customers are concerned.”
Techcrunch, March 30th 2022

Lapsus$ were only just in the news days ago with an Oxford teen accused of being multi-millionaire cyber-criminal connected with the group. Joe Tidy has an excellent article of what happened and how the teen in question was “doxxed” over on the BBC.

ITPro also cover this with comment from ourselves:

“From the paths I have looked at so far it looks like legitimate source code for mobile apps,” said Amir Hadžipašić, CEO and founder of SOS Intelligence to IT Pro. “It looks like there are internal microsites and data for them too, CVs and other personal information.
“That’s not all, they have full private keys for certs in most of the directories,” he added. “That there would be enough for me to stand up a website and serve their SSL and it be valid.”
IT Pro, 30th March 2022

Last but not least, we spoke to Bleeping Computer who have also covered this:

“In terms of legitimacy, going just by volume alone it’s hard to fabricate that amount of data – however samples of the data have been cross referenced with live systems and other methods that show the leak is legitimate and very significant as far as Globant and Globant’s impacted customers are concerned”.
Bleeping Computer, March 30 2022

For any size organisation, we help you sleep easier by giving you real time alerts of key phrases, emails and domains that appear on the Dark Web. For a demo, click here and we look forward to helping you.

Photo by Clint Patterson on Unsplash.

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

The SOS Intelligence CVE Chatter Weekly Top Ten – 25 July 2022

The SOS Intelligence CVE Chatter Weekly Top Ten – 18 July 2022

What is Cyber Threat Intelligence?

LAPSUS$ – A Study of Cyber Threat Intelligence Successes

FAQ

The SOS Intelligence CVE Chatter Weekly Top Ten – 11 July 2022

The SOS Intelligence CVE Chatter Weekly Top Ten – 04 July 2022

The SOS Intelligence CVE Chatter Weekly Top Ten – 27 June 2022

The SOS Intelligence CVE Chatter Weekly Top Ten – 20 June 2022

Why MSSPs need Cyber Intelligence from SOS Intelligence

Scouring the Dark Web is no easy task, and very difficult without proper software and a large team of researchers.

How does one index and analyse such a vast network in an affordable and time efficient manner?

Announcing The SOS Intelligence CVE Chatter Weekly Top Ten

We’ve developed a process which gathers a list of the most discussed Common Vulnerabilities and Exposures (CVE) online for the previous week.

SOS Intelligence analysing Lapsus$ data and breaches

Recent Posts

Recent Comments