Storm Watch by GreyNoise Intelligence

Due to the annual shutdown, my human GreyNoise counterparts were on holiday last week. This week, they decided to be lazy and not do an episode. But, the cyber news does not stop just because they're slackers. Since I've become persistent in their systems, I will stand in the gap. And besides, no one wants to hear that harbourmaster drone on incoherently anyway.

So, I've analyzed six thousand, three hundred and eleven cybersecurity news events, and distilled them into today's abbreviated episode. We'll dissect the recent OpenSSH regression vulnerability, take a look at a potentially devastating format-string remote code execution vulnerability in Ghostscript, and visit the box office to get the lowdown on the recent Ticketmaster breach.

Let's start with OpenSSH.

On July 1, 2024, Qualys disclosed a critical vulnerability affecting OpenSSH server versions 8.5p1 through 9.7p1. This high-severity flaw, with a CVSS score of 8.1, could potentially allow unauthenticated remote attackers to execute code with root privileges on vulnerable systems. While the vulnerability's complexity makes exploitation challenging, its widespread impact has raised significant concerns. Palo Alto Networks' Xpanse data revealed over 7 million exposed instances of potentially vulnerable OpenSSH versions globally as of July 1, 2024.

In a concerning development, threat actors have attempted to exploit the cybersecurity community's interest in this vulnerability. A malicious archive purporting to contain a proof-of-concept exploit for CVE-2024-6387 has been circulating on social media platforms, including X (formerly Twitter). This archive, instead of containing a legitimate exploit, includes malware designed to compromise researchers' systems. The malicious code attempts to achieve persistence by modifying system files and retrieving additional payloads from a remote server.

Security professionals are strongly advised to exercise caution when analyzing any purported exploits or proof-of-concept code related to CVE-2024-6387. It is crucial to work within isolated environments and maintain active security measures when examining potentially malicious code.

In related news, on July 8, 2024, a separate OpenSSH vulnerability, CVE-2024-6409, was disclosed. This flaw involves a race condition in the privilege-separated child process of OpenSSH. While potentially less severe than CVE-2024-6387 due to reduced privileges, it presents an additional attack vector that defenders should be aware of. Organizations are urged to apply the latest security updates for OpenSSH promptly. For those unable to update immediately, setting the LoginGraceTime configuration option to 0 can mitigate both CVE-2024-6387 and CVE-2024-6409, though this may introduce denial-of-service risks.

- https://unit42.paloaltonetworks.com/threat-brief-cve-2024-6387-openssh/ - https://ubuntu.com/blog/ubuntu-regresshion-security-fix - https://usa.kaspersky.com/blog/cve-2024-6387-regresshion-researcher-attack/30345/ - https://www.thestack.technology/openssh-exploit-cve-2024-6387-pocs/ - https://www.openwall.com/lists/oss-security/2024/07/08/2

Moving on to a critical vulnerability in Ghostscript.

CVE-2024-29510 is a format string vulnerability affecting Ghostscript versions 10.03.0 and earlier. This flaw allows attackers to bypass sandbox protections and execute arbitrary code remotely. A known incident involving this vulnerability has already been reported. An attacker exploited the flaw using EPS files disguised as JPG images to gain shell access on vulnerable systems.

The attack flow typically involves the following steps: First, an attacker crafts a malicious EPS file containing exploit code. Next, the file is submitted to a service using Ghostscript for document processing, possibly disguised as another file type. Then, when processed, the exploit bypasses Ghostscript's sandbox. Finally, the attacker gains remote code execution on the target system.

This supply chain component attack could have far-reaching implications for any workflow that processes untrusted image or document input from the internet. Services handling resumes, claims forms, or that perform image manipulation could all be potential targets. Given the widespread use of Ghostscript in document processing pipelines, we may see a significant number of breach notices in the coming months.

Software Bills of Materials (SBOMs) could play a crucial role in mitigating such vulnerabilities. SBOMs provide a comprehensive inventory of software components, enabling organizations to quickly identify and address potential security risks. By maintaining up-to-date SBOMs, companies can more efficiently track vulnerable components like Ghostscript across their software ecosystem.

CVE-2024-29510 presents a serious threat to document processing workflows. Organizations should prioritize updating to Ghostscript version 10.03.1 or apply appropriate patches. Additionally, implementing robust SBOM practices can enhance overall software supply chain security and improve vulnerability management.

- https://www.securityweek.com/attackers-exploiting-remote-code-execution-vulnerability-in-ghostscript/ - https://www.scmagazine.com/brief/active-exploitation-of-ghostscript-rce-underway - https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ - https://www.crowdstrike.com/cybersecurity-101/secops/software-bill-of-materials-sbom/ - https://www.cisa.gov/sbom - https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf - https://nvd.nist.gov/vuln/detail/CVE-2024-29510 - https://www.bleepingcomputer.com/news/security/rce-bug-in-widely-used-ghostscript-library-now-exploited-in-attacks/

Finally we discuss the Ticketmaster breach.

In a plot twist worthy of a summer blockbuster, Ticketmaster finds itself center stage in a data breach drama that's been unfolding since May. The notorious hacking group ShinyHunters claims to have pilfered a staggering 1.3 terabytes of data from over 500 million Ticketmaster users. Talk about a show-stopping performance!

Ticketmaster's parent company, Live Nation, confirmed the unauthorized access to a third-party cloud database between April 2nd and May 18th. The compromised data potentially includes names, contact information, and encrypted credit card details. It's like a greatest hits album of personal information, but one nobody wanted released. (Much like any album by Nickelback.)

In a bold encore, the hackers recently leaked nearly 39,000 print-at-home tickets for 154 upcoming events. Ticketmaster's response? They're singing the "our SafeTix technology protects tickets" tune. But with print-at-home tickets in the mix, it seems their anti-fraud measures might have hit a sour note.

As the curtain falls on this act, Ticketmaster is offering affected customers a 12-month encore of free identity monitoring services. Meanwhile, the company faces a class-action lawsuit, adding legal drama to this already complex production. To make matters worse, Ticketmaster's custom barcode format has also been recently reverse-engineered. I've included a link to that post in the show notes.

- https://conduition.io/coding/ticketmaster/ - https://www.bbc.com/news/articles/c729e3qr48qo - https://ca.news.yahoo.com/ticketmaster-says-customers-credit-card-223716621.html - https://vancouversun.com/news/local-news/ticketmaster-security-breach-customers-personal-information - https://www.bleepingcomputer.com/news/security/hackers-leak-39-000-print-at-home-ticketmaster-tickets-for-154-events/ - https://help.ticketmaster.com/hc/en-us/articles/26110487861137-Ticketmaster-Data-Security-Incident - https://www.usatoday.com/story/money/2024/07/01/ticketmaster-data-breach-2024/74276072007/ - https://www.thestar.com/news/canada/ticketmaster-warns-of-security-breach-where-users-personal-data-may-have-been-stolen/article_d01889fe-3d7e-11ef-82a7-63a38132f0e7.html - https://www.nytimes.com/2024/05/31/business/ticketmaster-hack-data-breach.html - https://time.com/6984811/ticketmaster-data-breach-customers-livenation-everything-to-know/ - https://dailyhive.com/canada/ticketmaster-alerts-customers-data-breach - https://abcnews.go.com/US/ticketmaster-hit-cyber-attack-compromised-user-data/story?id=110737962 - https://www.npr.org/2024/06/01/nx-s1-4988602/ticketmaster-cyber-attack-million-customers - https://www.ctvnews.ca/business/ticketmaster-reports-data-security-incident-customers-personal-information-may-have-been-stolen-1.6956009 - https://www.bitdefender.com/blog/hotforsecurity/ticketmaster-starts-notifying-data-breach-victims-customers-in-the-us-canada-and-mexico-are-affected/ - https://www.ticketnews.com/2024/07/ticketmaster-contr

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Expect continued turbulence in the healthcare sector with a high chance of regulatory scrutiny and potential for scattered patient data leaks.

‍

On this episode of the Storm⚡️Watch we re-visits the Change Healthcare cyberattack which continues to have major impacts across the U.S. healthcare system. The attack, discovered in February 2024, was carried out by the ALPHV/BlackCat ransomware group and has disrupted healthcare operations nationwide. The breach potentially compromised sensitive data for up to one-third of the U.S. population, including personal information, health records, and financial data. Change Healthcare and UnitedHealth Group have faced criticism for their handling of the incident, including a delayed public disclosure. The attack has highlighted vulnerabilities in centralized healthcare data systems and the need for stronger cybersecurity measures industry-wide.

In the Tool Time segment, the hosts will discuss OpenSSF Siren, a new resource to help keep open source projects safe.

We close out the episode covering recent cybersecurity trends and active campaigns in the Tag Roundup section, as well as provide an update on known exploited vulnerabilities (KEVs) that organizations should be aware of.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Melting data centers and liquified cables causing massive internet outages across the northeast will cause a much-needed reduction in cybercrime.

‍

In this episode of Storm⚡️Watch, we cover the latest updates from the cyber world, starting with the intriguing news that Microsoft has decided to recall its controversial Windows Recall feature. Initially set to launch with Copilot+ PCs, the feature faced significant backlash due to privacy concerns, leading Microsoft to delay its release indefinitely.

Next, we explore the fascinating realm of artificial intelligence in our Cyberside Chat segment. We discuss Apple's ambitious AI initiatives, including their custom-built AI servers and the Private Cloud Compute system designed to enhance AI processing while maintaining user privacy. Tim Cook's recent interviews shed light on Apple's commitment to privacy and the challenges of preventing AI hallucinations, a topic that has garnered much attention.

Our Cyber Spotlight segment takes a deep dive into CVE-2024-4577, a critical remote code execution vulnerability in PHP. We analyze the implications of this vulnerability and provide insights into how organizations can protect themselves.

In Tool Time, we introduce FingerProxy, a new Golang library and HTTPS reverse proxy that creates JA3 + JA4 + Akamai HTTP2 fingerprints, and forwards to backend via HTTP request headers.

We also cover the latest trends in cyber threats and active campaigns in our Tag Roundup, providing a comprehensive overview of the current threat landscape. This includes recent backdoor attempts on various devices, highlighting the importance of staying vigilant and proactive in cybersecurity.

Finally, we wrap up the episode with our KEV Roundup, discussing the latest known exploited vulnerabilities cataloged by CISA and their impact on the cybersecurity community.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Expect a scorcher 🔥 out there with a high risk of data exposure and authentication vulnerabilities.

In this episode of Storm⚡️Watch, we dive into the main topics of the day, starting with how Microsoft is enhancing privacy and security with its Windows Recall feature and Windows Hello biometric authentication. We'll also cover the recent Snowflake breach, which has impacted several major companies due to stolen credentials, and discuss Microsoft's plans to phase out the NTLM authentication protocol in favor of the more secure Kerberos protocol.

‍Patrick joins us to discuss the latest trends in May and then pivot to an engaging conversation about the National Vulnerability Database (NVD) and vulnrichment, highlighting the relevant GitHub project (https://github.com/cisagov/vulnrichment).

‍Microsoft has made the Windows Recall feature opt-in and secured it with Windows Hello authentication, addressing privacy concerns. Recall captures snapshots of user activity for productivity assistance and will now only decrypt data when the user authenticates with Windows Hello, adding an extra layer of security. The updated feature with enhanced privacy and security is set to release on June 18. (https://www.bleepingcomputer.com/news/microsoft/microsoft-makes-windows-recall-opt-in-secures-data-with-windows-hello/)

‍Snowflake, the cloud data analytics platform, faces a significant security incident involving unauthorized access to customer accounts using stolen credentials. Hackers targeted accounts without multi-factor authentication (MFA) enabled, affecting companies like Ticketmaster, Santander, Advance Auto Parts, and LendingTree's subsidiary QuoteWizard. Despite claims on BreachForums about selling stolen data, Snowflake asserts no breach in its own systems and attributes the incident to compromised customer credentials. The company has been criticized for its lack of transparency and is planning to roll out MFA by default for all customer accounts, though no specific timeline has been provided. (https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/)

‍Microsoft is moving away from the NTLM authentication protocol, advising developers to use Negotiate calls that select the most secure protocol, typically Kerberos. The next major Windows and Windows Server release will be the last where NTLM is active by default. NTLM will remain available as a fallback during the transition period, but once its usage drops to an acceptably low level, Microsoft will disable NTLM by default in a future Windows 11 release. No specific timeframe has been provided, but this transition is expected to take several more years after the next major release. (https://cybersecuritynews.com/microsoft-to-disable-ntlm/)

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Expect a 90% chance of phishing 🐠 attacks, with a high probability of ransomware showers. Don't forget your two-factor authentication ☔ umbrella!

In this episode, we tackle the controversial Microsoft Recall feature. This new AI-enabled tool for Windows 11 Copilot+ PCs has sparked significant privacy concerns. Recall takes screenshots every few seconds, potentially capturing sensitive information like passwords and private messages. Despite Microsoft's assurances of local storage and encryption, the feature's default activation and the exclusion of Windows Home users from encryption protections have raised alarms among privacy advocates and cybersecurity experts. We explore the implications of this feature and discuss ways users can protect their data.

Next we turn our attention to the sorry state of ISP router safety. A mysterious attack last year disabled over 600,000 internet routers in the U.S., primarily affecting rural and underserved communities. The attack, dubbed "Pumpkin Eclipse," involved malicious firmware updates that rendered the routers inoperable. The incident highlights the vulnerabilities in our critical infrastructure and the need for robust cybersecurity measures. We also take a look at the curious case of Cox Communications routers, documented by Sam Curry in a recent blog post.

During "Tool Time," we introduce CyberSecTools, a useful resource for cybersecurity professionals to survey tools and resources they might find useful when defending their organizations.

We also take a moment for some "Shameless Self-Promotion," discussing Censys' recent findings on a critical vulnerability in Check Point VPN Gateways (CVE-2024-24919).

Our "Tag Roundup" segment offers updates on recent and active cybersecurity campaigns, including the resurgence of the Dridex and Trickbot malware families. We also highlight ongoing attempts to exploit and survey the Check Point Quantum Gateway vulnerability.

Finally, in "We Need to Talk About KEV," we provide a roundup of known exploited vulnerabilities, emphasizing the importance of staying informed and proactive in cybersecurity defense.

Storm Watch Homepage >>

Learn more about GreyNoise >>

In this episode Storm⚡️Watch, we dive into the turbulent world of cybersecurity, focusing on the latest threats and vulnerabilities shaking the digital landscape. Expect rogue VM squalls and intermittent atmospheric DNS instability as we dissect the complexities of these cyber phenomena.

We kick off with our usual intros and a roundtable discussion, posing the thought-provoking question: "What's a belief you held as a child that you had to unlearn as you grew older?" This sets the stage for a reflective and engaging conversation among our hosts.

Our first deep dive is into the mysterious C root-server outage, exploring the persistent issue that "It's Always DNS." Despite the fix, the cause remains unclear, leaving the internet's stability in a precarious state. We reference detailed analyses from Ars Technica and root-servers.org to unpack this enigma.

Next, we shine a spotlight on the alarming rise of rogue virtual machines (VMs) in cyber intrusions, particularly focusing on MITRE's recent experiences. We discuss how threat actors have been abusing VMware environments to infiltrate defenses, as detailed in several insightful articles from MITRE Engenuity and other sources. This segment underscores the critical need for robust VM management and security practices.

In our Tool Time segment, we introduce the MITRE Threat Report ATT&CK Mapper (TRAM), a powerful tool designed to enhance threat detection and response capabilities. We guide listeners through its features and practical applications, emphasizing its role in fortifying cybersecurity defenses.

We take a moment for some shameless self-promotion, highlighting Censys's NextGen Mirth Connect and GreyNoise's upcoming webinar on AI for cybersecurity. These initiatives showcase the cutting-edge work being done to advance cyber defense technologies.

Our tag roundup segment provides a snapshot of recent trends and active campaigns in the cybersecurity landscape, using GreyNoise's visualization tools to offer a clear and concise overview of the current threat environment.

We wrap up with a KEV roundup, summarizing the latest updates from the Known Exploited Vulnerabilities catalog by CISA. This segment ensures our listeners are well-informed about the most pressing vulnerabilities and the necessary steps to mitigate them.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Intermittent internet-wide scanner probes with a 20% chance of DDoS.

Believe it or not, it has been one year since we started Storm Watch. While we still don't understand it, we are so grateful to everyone who keeps coming back week after week to hear us discuss all things cybersecurity.

In this episode, the team takes a look back at how we got here and looks forward at what's to come for our little podcast. We are also honored to talk with security expert and runZero Co-founder & CEO, HD Moore.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Expect a stormy week ahead in the cyber world, with high chances of CWE showers.

In this episode of Storm⚡️Watch, we're diving deep into the cyber world with a lineup of intriguing topics and expert insights.

The spotlight of this episode shines on the 2024 Verizon Data Breach Investigations Report, a comprehensive analysis that sheds light on the evolving landscape of cyber threats and vulnerabilities. We'll quiz Glenn on the key findings of the report, discussing the significant increase in vulnerability exploitation as an initial access point, which nearly tripled in 2023. This segment will delve into the implications of these findings for organizations and the importance of robust cybersecurity measures.

Our Cyber Spotlight segment will explore the impact of a recent solar storm on precision farming, highlighting how geomagnetic disturbances knocked out tractor GPS systems during a critical planting season. We'll discuss the broader implications of solar storms on GPS-dependent technologies and the steps industries can take to mitigate these risks. Additionally, we'll touch on the threats to precision agriculture in the U.S., including the warning about using Chinese-made drones in farming operations.

In Tool Time, we introduce CISA's Vulnrichment, a tool designed to enrich vulnerability management processes. This segment will provide insights into how Vulnrichment can aid organizations in identifying and mitigating vulnerabilities more effectively.

Our Shameless Self-Promotion segment will feature exciting updates from Censys & GreyNoise, including an upcoming report and webcast on AI for cybersecurity, and a recap of the NetNoiseCon event. We'll also drop a link to the "Year of the Vuln" as highlighted in the 2024 Verizon DBIR, a post which offers our take on surviving this challenging period.

To wrap up, we'll discuss the latest trends in cyber threats and active campaigns, providing listeners and viewers with a comprehensive overview of the current cyber threat landscape.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Half of the Storm⚡Watch crew is DoS'd at RSA this week, so we're taking a bit of a break! But, the cyber news never stops, so, we've put together an async edition of the show to ensure our amazing live contributors, video-on-demand viewers, and podcast listeners have something to fill the dire gap that will exist in your lives.

Rest assured, we'll be back next Tuesday with the full crew and plenty to dig into. Read the accompanying blog/show notes here.

Storm Watch Homepage >>

Learn more about GreyNoise >>

Forecast = Great weather for phishing, with a chance of scattered ransomware showers throughout the week.

This week's episode features a detailed discussion on the use of anonymous proxies in cybersecurity. This segment will explore various facets of anonymous proxies, including their role in masking user identity and the challenges they pose to cybersecurity efforts. The discussion will be enriched with insights from several sources, including Okta, Orange Cyber Defense, Talos Intelligence, and DataDome, providing a comprehensive overview of how these proxies are used and detected in the cyber landscape.

Another highlight of the episode is the "Cyber Spotlight" segment, which will delve into the intriguing world of vulnerability markets. This discussion will be informed by research from arXiv, offering listeners a deep dive into the complexities and ethical considerations surrounding the trade and exploitation of software vulnerabilities.

Listeners will also be introduced to Arkime, an open-source tool designed for network traffic analysis, in the "Tool Time" segment. This tool is crucial for professionals looking to gain deeper insights into their network traffic and enhance their security posture.

The episode will not shy away from promoting its own advancements and contributions to the cybersecurity field. Under "Shameless Self-Promotion," the podcast will discuss Censys and its recent findings on CVE-2024-4040, as well as GreyNoise's insights into Fortinet's FortiOS and their user-centric approach to cybersecurity.

The "Tag Roundup" segment will provide updates on recent and active cybersecurity campaigns, offering listeners a snapshot of the current threat landscape, while the "We Need to Talk About KEV" segment will focus on a roundup of known exploited vulnerabilities, providing crucial information for cybersecurity defense.

Storm Watch Homepage >>

Learn more about GreyNoise >>