Lucifer Malware Targeting Windows Machines.

New self-propagating malware, named Lucifer, was discovered recently. Malware targets Windows machines with cryptojacking and DDoS (distributed denial-of-service) attacks.

Malware is trying to find and exploit unpatched vulnerabilities. Some of them were Microsift Windows (CVE-2017-0144, CVE-2017-0145, CVE-2017-8464), Rejetto HTTP File Server (CVE-2014-6287), ThinkPHP RCE (CVE-2018-20062), Apache Struts (CVE-2017-9791), Lavarel Framework (CVE-2019-9081).

After exploiting, attacker connects to the C2 (command-and-control) server and executes arbitrary commands (TCP, UDP, HTTP DoS attack etc.).

Malware is self-propagating. It uses brute-force technique on the open TCP ports or Remote Procedure Call to get in. When in, Lucifer uses Certutil.exe command-line program to propagate itself.

A Flaw in Mozilla Firefox was discovered by Cisco Talos.

Marcin “Icewall” Noga, researcher from Cisco Talos, found a vulnerability (CVE-2020-12405) in Mozilla’s SharedWorkerService. This flaw, if exploited, allows attackers to remotely execute code on the victim’s machine through a use-after-free vulnerability. To trigger this vulnerability user needs to visit a malicious web site resulting remote code execution. Mozilla and Cisco Talos are working together to make sure a flaw is fixed.

Google Researchers found a flaw in VMware.

Cfir Cohen, researcher from Google, reported a vulnerability which affects Workstation, Fusion and vSphere virtualization products. A Flaw was marked as CVE-2020-3960 and is a read vulnerability which allows attackers without admin access to read a privileged information.

The flaw was patched and update is available.

Another Critical Flaws in Adobe Flash Player and Framemaker.

Adobe patched four critical flaws in Flash Player and Framemaker. Vulnerabilities, if exploited, might allow arbitrary code execution.

Two bugs in Adobe Framemaker (CVE-2020-9634, CVE-2020-9635) were found by Francis Provencher at Trend Micro’s ZDI (Zero Day Initiative). CVE-2020-9634 is related to the GIF files parsing, CVE-2020-9635 – to PDF files parsing.

Another critical bug patched by Adobe (CVE-2020-9636) originates from memory corruption and can cause huge impact from program crash to remote code execution.

As for Adobe Flash Player, discovered critical flaw (CVE-2020-9633) might lead to the code execution.

Additionally, Adobe did patch few important flaws including XSS, server-side request forgery glitches etc.

Updates are available.

OSS Vulnerabilities: 2019 vs 2018.

According to the RiskSense report, a number of OSS vulnerabilities increased from 421 CVEs in 2018 to 968 in 2019.  The study also confirmed that it takes much longer to report and add these vulnerabilities to a National Vulnerability Database (NVD). It creates a risk for companies which continue to use the open-source resources.

The most CVEs were found in the Jenkins automation server (646) and MySQL (624).

The most common types of weaknesses are XSS (Cross-Site Scripting) and Input Validation, but much more types were reported as less common, such as Deserialization, Error Handling etc.

Covid-19 Attacks: Healthcare Targets.

During the COVID-19 pandemic healthcare system became a favourite target for hackers, including research centres and educational institutions. The latest attack was observed in the University of California (San Francisco). University reported an attack without providing any details about affected structures.

Previously in March Canadian government health organization, engaged in the COVID-19 response, was targeted with an open-source ransomware.

In May the FBI and Cybersecurity and Infrastructure Security Agency reported an attack to U.S. research and healthcare institutions which are involved in COVID-19 vaccine trials.

Considering the increase of remote working during the pandemic, healthcare system became more vulnerable. Phishing is a number one attack vector. Also lack of established security policies and employees awareness trainings increases success of the conducted attacks.