Search giant Google on Friday released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser.
The high-severity flaw, tracked as CVE-2022-4262, concerns a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google’s Threat Analysis Group (TAG) has been credited with reporting the issue on November 29, 2022.
Type confusion vulnerabilities could be weaponized by threat actors to perform out-of-bounds memory access, or lead to a crash and arbitrary code execution.
According to the NIST’s National Vulnerability Database, the flaw permits a “remote attacker to potentially exploit heap corruption via a crafted HTML page.”
Google acknowledged active exploitation of the vulnerability but stopped short of sharing additional specifics to prevent further abuse.
CVE-2022-4262 is the fourth actively exploited type confusion flaw in Chrome that Google has addressed since the start of the year. It’s also the ninth zero-day flaw attackers have exploited in the wild in 2022 –
Users are recommended to upgrade to version 108.0.5359.94 for macOS and Linux and 108.0.5359.94/.95 for Windows to mitigate potential threats.
Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.
LastPass maintains that passwords remain safely encrypted.
Password manager LastPass announced Wednesday it had suffered its second data breach in three months. CEO Karim Toubba said the company recently detected unusual activity within a third-party cloud storage service that is shared by LastPass and affiliate GoTo. He said an investigation was immediately launched into the incident by security firm Mandiant and that law enforcement had been alerted.
“We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture,” Toubba said.
LastPass is working to identify what specific information has been accessed and the scope of the incident.
Products and services remain fully functional, and LastPass said it continues to deploy enhanced security measures and monitoring capabilities across its infrastructure. Toubba said further updates would be provided as LastPass learns more details.
In August, LastPass said an unauthorized party had gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.
Following an investigation, Toubba said in September that the threat actor’s activity had been limited to a four-day period and confirmed that there is no evidence this incident involved any access to customer data or encrypted password vaults. “We recognize that security incidents of any sort are unsettling but want to assure you that your personal data and passwords are safe in our care,” he said then.
The new ‘AXLocker’ ransomware family is not only encrypting victims’ files and demanding a ransom payment but also stealing the Discord accounts of infected users.
When a user logs into Discord with their credentials, the platform sends back a user authentication token saved on the computer. This token can then be used to log in as the user or to issue API requests that retrieve information about the associated account.
Threat actors commonly attempt to steal these tokens because they enable them to take over accounts or, even worse, abuse them for further malicious attacks.
As Discord has become the community of choice for NFT platforms and cryptocurrency groups, stealing a moderator token or other verified community member could allow threat actors to conduct scams and steal funds.
AxLocker is a two-in-one threat
Researchers at Cyble recently analyzed a sample of the new AXLocker ransomware and discovered that it not only encrypts files but also steals a victim’s Discord tokens.
As ransomware, there is nothing particularly sophisticated about the malware or the threat actors who use it.
When executed, the ransomware will target certain file extensions and exclude specific folders, as shown in the image below.
Targeted files (left) and excluded directories (right)(Cyble)
When encrypting a file, AXLocker uses the AES algorithm, but it does not append a filename extension on the encrypted files, so they appear with their normal names.
Next, AXLocker sends a victim ID, system details, data stored in browsers, and Discord tokens to the threat actors’ Discord channel using a webhook URL.
To steal the Discord token, AxLocker will scan the following directories for and extract tokens using regular expressions:
Eventually, victims are served a pop-up window containing the ransom note, informing them that their data was encrypted and how they contact the threat actor to purchase a decryptor.
Victims are given 48 hours to contact the attackers with their victim ID, but the ransom amount isn’t mentioned in the note.
AXLocker ransom note(Cyble)
While this ransomware clearly targets consumers rather than the enterprise, it could still pose a significant threat to large communities.
Therefore, if you find that AxLocker encrypted your computer, you should immediately change your Discord password, as it will invalidate the token stolen by the ransomware.
While this may not help recover your files, it will prevent further compromise of your accounts, data, and the communities you are involved in.
A threat group tracked as ‘Worok’ hides malware within PNG images to infect victims’ machines with information-stealing malware without raising alarms.
This has been confirmed by researchers at Avast, who built upon the findings of ESET, the first to spot and report on Worok’s activity in early September 2022.
ESET warned that Worok targeted high-profile victims, including government entities in the Middle East, Southeast Asia, and South Africa, but their visibility into the group’s attack chain was limited.
Avast’s report is based on additional artifacts the company captured from Worok attacks, confirming ESET’s assumptions about the nature of the PNG files and adding new information on the type of malware payloads and the data exfiltration method.
Hiding malware in PNG files
While the method used to breach networks remains unknown, Avast believes Worok likely uses DLL sideloading to execute the CLRLoader malware loader into memory.
This is based on evidence from compromised machines, where Avast’s researchers found four DLLs containing the CLRLoader code.
Next, the CLRLoader loads the second-stage DLL (PNGLoader), which extracts bytes embedded in PNG files and uses them to assemble two executables.
Worok’s complete infection chain Source: Avast
Hiding payload in PNGs
Steganography is concealing code inside image files that appear normal when opened in an image viewer.
In the case of Worok, Avast says the threat actors used a technique called “least significant bit (LSB) encoding,” which embeds small chunks of the malicious code in the least important bits of the image’s pixels.
LSB on image pixels Source: Avast
The first payload extracted from those bits by PNGLoader is a PowerShell script that neither ESET nor Avast could retrieve.
The second payload hiding in the PNG files is a custom .NET C# info-stealer (DropBoxControl) that abuses the DropBox file hosting service for C2 communication, file exfiltration, and more.
The PNG image containing the second payload is the following:
A PNG image file containing the info-stealer Source: Avast
DropBox abuse
The ‘DropBoxControl’ malware uses an actor-controlled DropBox account to receive data and commands or upload files from the compromised machine.
The commands are stored in encrypted files on the threat actor’s DropBox repository that the malware accesses periodically to retrieve pending actions.
Form of DropBox files, TaskType is command Source: Avast
The supported commands are the following:
Run “cmd /c” with the given parameters
Launch an executable with given parameters
Download data from DropBox to the device
Upload data from the device to DropBox
Delete data on the victim’s system
Rename data on the victim’s system
Exfiltrate file info from a defined directory
Set a new directory for the backdoor
Exfiltrate system information
Update the backdoor’s configuration
These functions indicate that Worok is a cyberespionage group interested in stealthy data exfiltration, lateral movement, and spying on the infected device.
Avast comments that the tools sampled from Worok attacks aren’t circulating in the wild, so they’re likely used exclusively by the threat group.
The Federal Bureau of Investigation (FBI) says Americans who share their phone number online are being targeted by Google Voice authentication scams.
As the federal law enforcement agency explains, the fraudsters are targeting those who have posted their phone number as a form of contact when trying to sell various items on online marketplaces or social media apps.
“Recently, we have also been getting reports of people who are getting targeted in other locations, including sites where you post about lost pets,” the FBI said.
If successful, they will set up a Google Voice account in their victims’ names or hijack their Gmail accounts which will later be used in other fraud schemes or in phishing attacks.
The scammers will reach out to their targets via text messages or email showing their interest in the item put up for sale, asking the seller to verify their offer is legitimate and they’re a real person and not a bot by sharing an authentication code they’ll receive from Google.
“What he is really doing is setting up a Google Voice account in your name using your real phone number as verification,” the agency added.
“Once set up, he can use that Google Voice account to conduct any number of scams against other victims that won’t come back directly to him. He can also use that code to gain access to, and take over, your Gmail account.”
What to do if you’re the target of an authentication scam
The FBI advises victims of Google Voice authentication scams to check Google’s support website for information on how to retake control of their Google Voice account and reclaim their Voice number.
The federal agency also provides the following tips on to avoid getting scammed in the first place if you’re ever targeted:
Never share a Google verification code with others.
Only deal with buyers, sellers, and Fluffy-finders in person. If money is to exchange hands, make sure you are using legitimate payment processors.
Don’t give out your email address to buyers/sellers conducting business via phone.
Don’t let someone rush you into a sale. If they are pressuring you to respond, they are likely trying to manipulate you into acting without thinking.
Those who believe they’ve fallen victim to online scams, are advised to report it to the FBI’s Internet Crime Complaint Center at www.ic3.gov or to call their local FBI office.
ODUWACOIN RSS FEED INTEGRATED WITH CRYPTO.COM’S PRICE PAGE
Through Crypto.com’s Oduwacoin price page, you can now directly access Oduwa’s RSS news feed. This feature will enable Crypto.com users to obtain the latest news and updates on Oduwacoin. Oduwacoin is an autonomous decentralized cryptocurrency that serves as a medium of exchange to settle transactions for People of African descent and minorities worldwide.
Oduwacoin is the first indigenous Pan- African cryptocurrency to give a right to Ownership, store of value, and payment settlement with no fees worldwide.
Crypto.com users can stay on top of the latest updates regarding Oduwa’s products and services in addition to access to the latest OWC price, trading volume, live charts, and market capitalization data.
This announcement follows the listing of Oduwacoin RSS news feed on the Crypto.com App price page and features Oduwacoin on crypto.com monthly blog update!
In addition to OWC, there are currently over 100 cryptocurrencies listed on Crypto.com App and available for trade. Crypto.com Visa Cards enables users to easily convert multiple cryptocurrencies into fiat, which can be spent at any merchant worldwide.
Oduwacoin — The Leading Pan-African Cryptocurrency For Faster and No Fee Transactions on The Continent of Africa and Indigenous Communities of the World.
About Oduwacoin
Oduwacoin is an open-source cryptocurrency. The first indigenous Cryptocurrency designed to empower people of African descent. It is the most viable alternative cryptocurrency to Bitcoin, a medium of exchange wherein individual coin ownership records are stored in a decentralized ledger using cryptography. Oduwacoin runs on its native blockchain to secure transaction records, control the creation of additional coins, and verify the transfer of coin ownership.
Oduwacoin was launched in early 2018. Oduwa Blockchain Solutions was Co-founded by a Blockchain Strategist and developer called Bright Enabulele. He intends to get the common man to integrate into the use of cryptocurrency and make it possible for people in Africa and other remote places to have equal access to the global digital economy with the help of a cell phone and the internet. A strong blockchain advocate. Oduwa Blockchain Solutions believes that blockchain is the single most important digital innovation of this day and age, as it will reshape how we transact and interact online.
Oduwa Blockchain Solutions Ltd is the creator of Oduwapay, the official mobile wallet app to send, receive, and store Oduwacoin. Oduwapay mobile wallet app was designed to facilitate micro settlements and cross-border transactions on the Oduwacoin ecosystem, drawing participants from the world’s biggest African and indigenous communities. They allow easy convertibility and a conventional gateway for multiple sovereign and local currencies in Africa and beyond to onboard Oduwacoin without any coin price manipulation. There are countless engagement opportunities for Oduwacoin holders, like energy-efficient pos mining called staking, gaming, NFTs, and payment settlement.
OduwaCoin Is 2022’s New Rising Cryptocurrency to Succeed Like Bitcoin. The No.1 cryptocurrency of choice for people of African descent. Oduwa Blockchain Solutions LTD is making Oduwacoin accessible worldwide and developing a smart city in Ghana where utilities and rent will be paid using Oduwacoin. Oduwa smart cities and Oduwa paradise will be built-in multiple African Countries.
By integrating Oduwacoin news updates with Crypto.com’s Price Page, users can now stay up to date with OWC’s price history, price ticker, market cap, and much more.
About Crypto.com
Founded in 2016, Crypto.com has grown into a full-fledged and well-known international cryptocurrency hub in just a few short years. Its crypto ecosystem consists of the Crypto.com App, Crypto.com Exchange, Crypto.com Defi Wallet, Defi Swap, Crypto.com Visa Cards, Crypto Earn, Crypto Credit, Price Page, NFT marketplace, Ethereum Gas Fees Tracker, and many other services. Crypto.com works with regulatory institutions all over the globe and aims to bring you the most convenient way to buy, sell, trade, and spend cryptocurrencies. The Crypto.com App allows users to buy over 100 top cryptocurrencies at true cost, earn high interest on their crypto, manage their Crypto.com Visa Card, easily make crypto payments, and many other rewarding features. The company’s Crypto.com Defi Wallet is non-custodial so that users can have full control of their private keys.
Crypto.com is a highly secure and regulated crypto platform with numerous security certifications and assessments awarded by top security auditors.
Wordfence analysts report having detected a massive wave of attacks in the last couple of days, originating from 16,000 IPs and targeting over 1.6 million WordPress sites.
The threat actors target four WordPress plugins and fifteen Epsilon Framework themes, one of which has no available patch.
Some of the targeted plugins were patched all the way back in 2018, while others had their vulnerabilities addressed as recently as this week.
IP addresses launching the attacks Source: Wordfence
The affected plugins and their versions are:
PublishPress Capabilities
Kiwi Social Plugin
Pinterest Automatic
WordPress Automatic
The targeted Epsilon Framework themes are:
Shapely
NewsMag
Activello
Illdy
Allegiant
Newspaper X
Pixova Lite
Brilliance
MedZone Lite
Regina Lite
Transcend
Affluent
Bonkers
Antreas
NatureMag Lite – No patch available
Attack numbers spiking in the last couple of days Source: Wordfence
“In most cases, the attackers are updating the users_can_register option to enabled and setting the default_role option to administrator,” Wordfence explains.
“This makes it possible for attackers to register on any site as an administrator effectively taking over the site.”
To check if your site has already been compromised, you can review all user accounts and look for any rogue additions that should be removed immediately.
Next, review the site’s settings at “http://examplesite[.]com/wp-admin/options-general.php” and pay attention to the Membership and the new user default role setting.
Checking settings on the site Source: Wordfence
It is recommended to update your plugins and themes as soon as possible, even if they’re not in the above list. If you’re using NatureMag Lite, for which there’s no fix, you should uninstall it immediately.
Note that updating the plugins won’t eliminate the threat if your site has already been compromised. In this case, you are advised to follow the instructions found in detailed clean-up guides first.
In general, try to keep the number of plugins at your WordPress site to the absolute minimum necessary as this dramatically reduces the chances of being targeted and hacked in the first place.
Keeping a close eye on your online accounts is incredibly important with scams, hacks, and breaches as common as they are. Your hardware is at risk as well, which is why we always recommend keeping your devices updated. In fact, one of the most indispensable devices in your home can also be one of the most vulnerable. Cyber Security researchers recently examined a number of popular WiFi routers and found over 200 potential security holes that could put your data at risk.
Popular WiFi routers have huge security holes
Editors at the German IT magazine CHIP recently conducted a thorough security test on nine routers from major brands. They teamed up with security experts from IoT Inspector, who provided a security platform for automated IoT firmware checks. What they found might shock you.
“The test negatively exceeded all expectations for secure small business and home routers,” Florian Lukavsky, CTO of IoT Inspector, said of the results of the test on Thursday. “Not all vulnerabilities are equally critical – but at the time of the test, all devices showed significant security vulnerabilities that could make a hacker’s life much easier.”
According to IoT Inspector, the test featured routers from Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys. Millions of units of each model are currently in circulation around the world. In all, the researchers found 226 vulnerabilities between the nine models.
Devices from TP-Link had the most vulnerabilities of any device. The company’s Archer AX6000 routers had a whopping 32 security holes. Meanwhile, Synology’s RT-2600ac router came in second place with 30 vulnerabilities. You can see the full list in this document (German).
Wireless internet router with status lights on. Image source: Oleksandr Delyk/Adobe
As IoT Inspector explains, many of the routers had the same vulnerabilities. In many cases, it was an outdated operating system. The researchers noted that integrating a new kernel in the firmware is expensive. As a result, none of the manufacturers were up to date.
The routers also weren’t on the latest software. Most routers update themselves automatically, but only if you enable the feature. Router updates aren’t as frequent as phone or computer updates, but they’re just as important.
The researchers contacted all of the affected manufacturers before publishing the report. Every manufacturer responded by releasing firmware patches for their routers. Even if your router isn’t on the list, take this opportunity to check for any outstanding firmware updates.
Additionally, the German government announced that manufacturers will have to take greater responsibility going forward. The new coalition agreement states that “manufacturers are liable for damage negligently caused by IT security vulnerabilities in their products.” So if hackers find and exploit security holes in routers in the future, manufacturers will pay the price.
What you can do to protect yourself
Of course, whether or not the manufacturer is responsible, your data is still at risk. IoT Inspector CEO Jan Wendenburg offered the following helpful hint for all router owners:
Changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network. The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto ‘plug, play and forget.’
Update your software, use strong passwords, and keep an eye out for reports such as these.
If you are an AT&T enterprise customer with some older technology on the edge of your network, your infrastructure may be under attack by a Russian botnet dubbed EwDoor.
In late October this year, researchers at 360 Netlab discovered a threat actor attacking Edgewater Networks’ devices using the four-year-old CVE-2017-6079. This vulnerability, when exploited, could allow the attacker to execute commands via a hidden page embedded in the firmware dating back to 2006, according to the National Institute of Standards and Technology’s database.
The basic logic of EwDoor’s operations.
Subsequently, the researchers named this botnet EwDoor after “it’s targeting of Edgewater producers and its Backdoor feature.” The initial version of this network used a multi-command-and-control (C2) redundancy mechanism, allowing the researchers to register one of the C2 domains and gain some insights into EwDoor. They found that the 5,700 attacked devices are “EdgeMarc Enterprise Session Border Controllers” belonging to AT&T and geographically located within the United States.
Since that initial insight was gained, the researchers briefly lost sight of EwDoor, but found that there have been three known updates for the network that “can be summarized into 2 main categories of DDoS attacks and Backdoor.” The thought is that with these capabilities, which also include “self-updating, port scanning, file management, reverse SHELL, and the execution of arbitrary commands,” the threat actor wishes to deny service and gather sensitive information like call logs.
Interestingly, the team at 360 Netlab was able to deconstruct the code from EwDoor and found some of the C2 domains and the locations for the downloaded files. Though these have likely changed since the research was published, it shows that the threat actor’s efforts to obfuscate their work had flaws.
In any event, AT&T spoke with BleepingComputer and stated that there was “no evidence of customers’ data being accessed as a result of these attacks.” Specifically, AT&T previously identified this issue, and the company has “taken steps to mitigate it and continue[s] to investigate.” Despite this reassurance, it is still concerning that something like this could happen, especially considering the crux of this attack is a highly dangerous four-year-old vulnerability.
Security researchers analyzed nine popular WiFi routers and found a total of 226 potential vulnerabilities in them, even when running the latest firmware.
The tested routers are made by Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys, and are used by millions of people.
The front-runners in terms of the number of vulnerabilities are the TP-Link Archer AX6000, having 32 flaws, and the Synology RT-2600ac, which has 30 security bugs.
Researchers at IoT Inspector carried out the security tests in collaboration with CHIP magazine, focusing on models used mainly by small firms and home users.
“For Chip’s router evaluation, vendors provided them with current models, which were upgrade to the latest firmware version,” Florian Lukavsky, CTO & Founder at IoT Inspector, told BleepingComputer via email.
“The firmware versions were automatically analyzed by IoT Inspector and checked for more than 5,000 CVEs and other security issues.”
Their findings showed that many of the routers were still vulnerable to publicly disclosed vulnerabilities, even when using the latest firmware, as illustrated in the table below.
Router models and flaws categorized as per their severity Source: CHIP Left column translated by BleepingComputer
While not all flaws carried the same risk, the team found some common problems that affected most of the tested models:
Outdated Linux kernel in the firmware
Outdated multimedia and VPN functions
Over-reliance on older versions of BusyBox
Use of weak default passwords like “admin”
Presence of hardcoded credentials in plain text form
Jan Wendenburg, the CEO of IoT Inspector, noted that one of the most important ways of securing a router is to change the default password when you first configure the device.
“Changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network.” explained Wendenburg.
“The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto ‘plug, play and forget’.”
The researchers didn’t publish many technical details about their findings, except for one case concerning the extraction of the encryption key for D-Link router firmware images.
The team found a way to gain local privileges on a D-Link DIR-X1560 and get shell access via the physical UART debug interface.
Next, they dumped the whole filesystem using built-in BusyBox commands and then located the binary responsible for the decryption routine.
By analyzing the corresponding variables and functions, the researchers eventually extracted the AES key used for the firmware encryption.
Deriving the AES key on CyberChef Source: IoT Inspector
Using that key, a threat actor can send malicious firmware image updates to pass verification checks on the device, potentially planting malware on the router.
Such problems can be solved with full-disk encryption that secures locally stored images, but this practice is not common.
Manufacturers responded quickly
All of the affected manufacturers responded to the researchers’ findings and released firmware patches.
CHIP’s author Jörg Geiger commented that the router vendors addressed most of the security flaws identified by the working group, but not all of them.
The researchers have told Bleeping Computer that the unpatched flaws are mostly lower importance vulnerabilities. However, they clarified that no follow-up tests were done to confirm that the security updates fixed the reported issues.
The vendor responses to CHIP (translated) were the following:
Asus: Asus examined every single point of the analysis and presented us with a detailed answer. Asus has patched the outdated BusyBox version, and there are also updates for “curl” and the web server. The pointed out that password problems were temp files that the process removes when it is terminated. They do not pose a risk.
D-Link: D-Link thanked us briefly for the information and published a firmware update that fixes the problems mentioned.
Edimax: Edimax doesn’t seem to have invested too much time in checking the problems, but at the end there was a firmware update that fixed some of the gaps.
Linksys: Linksys has taken a position on all issues classified as “high” and “medium”. Default passwords will be avoided in the future; there is a firmware update for the remaining problems.
Netgear: At Netgear they worked hard and took a close look at all problems. Netgear sees some of the “high” issues as less of a problem. There are updates for DNSmasq and iPerf, other reported problems should be observed first.
Synology: Synology is addressing the issues we mentioned with a major update to the Linux kernel. BusyBox and PHP will be updated to new versions and Synology will soon be cleaning up the certificates. Incidentally, not only the routers benefit from this, but also other Synology devices.
TP-Link: With updates from BusyBox, CURL and DNSmasq, TP-Link eliminates many problems. There is no new kernel, but they plan more than 50 fixes for the operating system
If you are using any of the models mentioned in the report, you are advised to apply the available security updates, enable “automatic updates”, and change the default password to one that is unique and strong.
Additionally, you should disable remote access, UPnP (Universal Plug and Play), and the WPS (WiFi Protected Setup) functions if you’re not actively using them.
Bleeping Computer has contacted all of the affected manufacturers requesting a comment on the above, and we will update this piece as soon as we receive their response.
.png)
