Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, May 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=8002, (Wed, May 11th)
This month we got patches for 75 vulnerabilities. Of these, 8 are critical, 3 were previously disclosed, and one is already being exploited according to Microsoft.
The already exploited vulnerability is a spoofing vulnerability affecting Windows LSA (CVE-2022-26925) with a CVSS score of 8.1. According to the advisory, âAn unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. This security update detects anonymous connection attempts in LSARPC and disallows it.â Additionally, Microsoft advises that further actions, detailed in KB5005413, are needed to protect the system after applying the patch. Microsoft also advises prioritizing domain controllers when applying patches. Regarding attack complexity, the advisory says it is âComplexâ given that the attacker must inject themselves into the logical network path between the target and the resource requested by the victim in order to read or modify network communications (MITM attack).
The highest CVSS score this month (9.8) is associated with a Remote Code Execution (RCE) Vulnerability affecting Windows Network File System (CVE-2022-26937). The vulnerability does not affect version NFSV4.1. So, as temporary mitigation, disabling versions NFSV2 and NFSV3 might be helpful. A similar vulnerability affecting NFS, discovered by the same researchers, was patched last month (CVE-2022-24497).
Continue reading Microsoft May 2022 Patch Tuesday, (Tue, May 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 10th, 2022 https://isc.sans.edu/podcastdetail.html?id=8000, (Tue, May 10th)
Last week, I found another interesting Word document that delivered an interesting malicious script to potential victims. Usually, Office documents carry VBA macros that are activated using a bit of social engineering (the classic yellow ribbon) but this time, the document did not contain any malicious code:
Continue reading Octopus Backdoor is Back with a New Embedded Obfuscated Bat File, (Mon, May 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, May 9th, 2022 https://isc.sans.edu/podcastdetail.html?id=7998, (Mon, May 9th)
TL;DR: Patch your BIG-IP and disconnect the management interface from the internet. Now.
Continue reading F5 BIG-IP Unauthenticated RCE Vulnerability (CVE-2022-1388), (Sun, May 8th)
I received several PDF like these in the past few days in my ISC mailbox and decided to look at 3 that were very similar. All 3 files are a one page picture with nothing else in it except a URL.
Continue reading Phishing PDF Received in my ISC Mailbox, (Sat, May 7th)
During a malware analysis class I taught recently, one of the students asked me what was &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;the simplest malware in the world&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d;. Of course, the answer to this question would depend heavily on one&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s definitions of &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x98;simplest&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99; and &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x98;malware&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;, as well as on a target hardware architecture and its operating system (and potentially additional software and other factors), but I thought that it was conceptually interesting enough to devote today&#;x26;#;39;s diary to.
Continue reading What is the simplest malware in the world?, (Fri, May 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=7996, (Fri, May 6th)