TCPDF version <=6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Skip to content

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-22640

**TCPDF vulnerable to Regular Expression Denial of Service**

Moderate severity GitHub Reviewed Published Apr 19, 2024 to the GitHub Advisory Database • Updated Apr 19, 2024

**Package**

composer tecnickcom/tcpdf (Composer)

**Affected versions**

<= 6.7.4

**Description**

Published to the GitHub Advisory Database

Apr 19, 2024

Last updated

Apr 19, 2024

GHSA-mx3p-fhpw-x6rv: TCPDF vulnerable to Regular Expression Denial of Service

CryptoChameleon attackers trade quantity for quality, dedicating time and resources to trick even the most diligent user into handing over their high-value credentials.

Source: II.studio via Shutterstock

An ongoing, highly sophisticated phishing campaign may have led some LastPass users to give up their all-important master passwords to hackers.

Password managers store all of a user's passwords — for Instagram, their job, and everything in between — in one place, protected by one "master" password. They unburden users from having to remember credentials for hundreds of accounts, and empower them to use more complicated, unique passwords for each account. On the other hand, if a threat actor gains access to the master password, they'll have keys to every single one of the accounts within.

Enter CryptoChameleon, a new, hands-on phishing kit of unparalleled realism. 

CryptoChameleon attacks tend not to be so widespread, but they're successful at a clip largely unseen across the cybercrime world, "which is why we typically see this targeting enterprises and other very high-value targets," explains David Richardson, vice president of threat intelligence at Lookout, which first identified and reported the latest campaign to LastPass. "A password vault is a natural extension, because you're obviously going to be able to monetize that at the end of the day."

Thus far, CryptoChameleon has managed to ensnare at least eight LastPass customers — but likely more — potentially exposing their master passwords.

**A Brief History of CryptoChameleon**

At first, CryptoChameleon looked like any other phishing kit.

Its operators had been around since late last year. In January, they began by targeting the cryptocurrency exchanges Coinbase and Binance. This initial targeting, plus its highly customizable toolset, earned it its name.

The picture changed in February, though, when they registered the domain fcc-okta\[.\]com, mimicking the Okta Single Sign On (SSO) page belonging to the US's Federal Communications Commission (FCC). "That suddenly made this rise from one of many consumer phishing kits that we see out there, to something that's going to pivot into targeting the enterprise, going after corporate credentials," Richardson recalls.

Richardson confirmed to Dark Reading that FCC employees were impacted, but could not say how many or whether the attacks led to any consequences for the agency. It was a sophisticated attack, he notes, that he expects to have worked even on trained employees.

The problem with CryptoChameleon wasn't just who it was targeting, but how well it did at defeating them. Its trick was thorough, patient, hands-on engagement with victims.

Consider, for example, the current campaign against LastPass.

It begins when a customer receives a call from an 888 number. A robo caller informs the customer that their account has been accessed from a new device. It then prompts them to press "1" to allow access, or "2" to block it. After pressing "2," they're told that they'll be receiving a call shortly from a customer service representative in order to "close the ticket."

Then the call comes in. Unbeknownst to the recipient, it's from a spoofed number. On the other end of the line is a live person, typically with an American accent. Other CryptoChameleon victims have also reported speaking with British agents.

"The agent has professional call center communication skills, and offers genuinely good advice," Richardson recalls from his many conversations with victims. "So, for example, they might say: 'I want you to write down this support phone number for me.' And they have victims write down the real support phone number for whoever they're impersonating. And then they give them a whole lecture: 'Only call us on this number.' I had a victim report that they actually said, 'For quality and training purposes, this call is being recorded.' They're using the full call script, everything that you can think of to make someone believe that they're really talking to this company right now."

This supposed support agent informs the user that they'll be sending an email shortly, allowing the user to reset access to their account. In fact, this is a malicious email containing a shortened URL, directing them to a phishing site.

The helpful support agent watches in real time as the user enters their master password into the copycat site. Then they use it to log into their account, and immediately change the primary phone number, email address, and master password, thereby locking the victim out for good.

All the while, Richardson says, "They don't realize it's a scam — none of the victims I talked to. One person said, 'I don't think I ever entered my master password in there.' \[I told them\] 'You spent 23 minutes on the phone with these guys. You probably did.'"

**The Damage**

LastPass shut down the suspicious domain used in the attack — help-lastpass\[.\]com — shortly after it went live. The attackers have been persistent, though, continuing their activity under a new IP address.

With visibility into the attackers' internal systems, Richardson was able to identify at least eight victims. He also offered evidence (which Dark Reading is keeping confidential) indicating that there may have been more than that.

When asked for further information, LastPass senior intelligence analyst Mike Kosak told Dark Reading, "We do not disclose details on the number of customers who are impacted by this type of campaign, but we support any customer who may be a victim of this and other scams. We encourage people to report potential phishing scams and other nefarious activity impersonating LastPass to us at \[email protected\]."

**Is There Any Defense?**

Because hands-on CryptoChameleon attackers talk their victims through any potential security barriers like multifactor authentication (MFA), defending against them begins with awareness.

"People need to be aware that attackers can spoof phone numbers — that just because an 800 or 888 number calls you, it doesn't mean that it's legitimate," Richardson says, adding that  "just because there's an American on the other end of the line also does not mean that it's legitimate."

In fact, he says, "Don't answer the phone from unknown callers. I know that's a sad reality of the world that we live in today."

Even with all the awareness and precautionary measures known to business users and consumers, though, a particularly sophisticated social engineering attack might still get through.

"One of the CryptoChameleon victims I talked to was a retired IT professional," Richardson recalls. "He said, 'I've gotten training my whole life to not fall for these kinds of attacks. Somehow I fell for it'."

LastPass has asked Dark Reading to remind customers of the following:

*   Ignore any unsolicited or unprompted incoming phone calls (automated or with a live individual) or texts claiming to be from LastPass related to a recent attempt to change your password and/or account information. These are part of an ongoing phishing campaign. 
    
*   If you do see this activity and are concerned you may have been compromised, contact the company at \[email protected\].
    
*   And finally, LastPass will never ask you for your password.
    

**About the Author(s)**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Multiple LastPass Users Lose Master Passwords to Ultra-Convincing Scam

### Summary
This is basically [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3) but instead of changing passwords, when enabling authentication.

### PoC
- Open Uptime Kuma with authentication disabled
- Enable authentication using another window
- Access the platform using the previously logged-in window
- Note that access (read-write) remains despite the enabled authentication
- Expected behaviour:
  - After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
- Actual behaviour:
  - The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.

### Impact
See [GHSA-g9v2-wqcj-j99g](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g) and [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3)

TBH this is quite a niche edge case, so I don't know if this even warrants a security report.  


Skip to content

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  GHSA-23q2-5gf8-gjpp

**Enabling Authentication does not close all logged in socket connections immediately**

Low severity GitHub Reviewed Published Apr 19, 2024 in louislam/uptime-kuma • Updated Apr 19, 2024

**Package**

npm uptime-kuma (npm)

**Affected versions**

<= 1.23.11

**Description**

**Summary**

This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.

**PoC**

*   Open Uptime Kuma with authentication disabled
*   Enable authentication using another window
*   Access the platform using the previously logged-in window
*   Note that access (read-write) remains despite the enabled authentication
*   Expected behaviour:
    *   After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
*   Actual behaviour:
    *   The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.

**Impact**

See GHSA-g9v2-wqcj-j99g and GHSA-88j4-pcx8-q4q

TBH this is quite a niche edge case, so I don't know if this even warrants a security report.

**References**

*   GHSA-23q2-5gf8-gjpp
*   GHSA-88j4-pcx8-q4q3
*   GHSA-g9v2-wqcj-j99g
*   louislam/uptime-kuma@7a9e2f5

Published to the GitHub Advisory Database

Apr 19, 2024

Last updated

Apr 19, 2024

GHSA-23q2-5gf8-gjpp: Enabling Authentication does not close all logged in socket connections immediately 

The world's most-visited deepfake website and another large competing site are stopping people in the UK from accessing them, days after the UK government announced a crackdown.

Two of the biggest deepfake pornography websites have now started blocking people trying to access them from the United Kingdom. The move comes days after the UK government announced plans for a new law that will make creating nonconsensual deepfakes a criminal offense.

Nonconsensual deepfake pornography websites and apps that “strip” clothes off of photos have been growing at an alarming rate—causing untold harm to the thousands of women they are used to target.

Clare McGlynn, a professor of law at Durham University, says the move is a “hugely significant moment” in the fight against deepfake abuse. “This ends the easy access and the normalization of deepfake sexual abuse material,” McGlynn tells WIRED.

Since deepfake technology first emerged in December 2017, it has consistently been used to create nonconsensual sexual images of women—swapping their faces into pornographic videos or allowing new “nude” images to be generated. As the technology has improved and become easier to access, hundreds of websites and apps have been created. Most recently, schoolchildren have been caught creating nudes of classmates.

The blocks on the deepfake websites in the UK were first spotted today, with two of the most prominent services displaying notices on their landing pages that they are no longer accessible to people visiting from the country. WIRED is not naming the two websites due to their enabling of abuse.

One of the websites with the restriction in place is the biggest deepfake pornography website existing today. Its homepage, when visiting from the UK, displays a message saying access is denied. “Due to laws or (upcoming) legislation in your country or state, we are unfortunately obligated to deny you access to this website,” the message says. It also shows the visitor’s IP address and country.

The other website, which also has an app, displays a similar message. “Access to the service in your country is blocked,” it says, before hinting there may be ways to get around the geographic restriction. The websites do not appear to have any restrictions in place when visiting from the United States, although may also be restricted in other countries.

It is not immediately clear why the sites have introduced the location blocks or whether they have done so in response to any legal orders or notices. Nor is it clear whether the blocks are temporary. Messages sent to the websites through email addresses and contact forms went unanswered. The creators of the websites have not posted any public messages on the websites or their social media channels about the blocks.

Ofcom, the UK’s communications regulator, has the power to persue action against harmful websites under the UK’s controversial sweeping online safety laws that came into force last year. However, these powers are not yet fully operational, and Ofcom is still consulting on them.

It’s likely the restrictions may significantly limit the amount of people in the UK seeking out or trying to create deepfake sexual abuse content. Data from Similarweb, a digital intelligence company, shows the biggest of the two websites had 12 million global visitors last month, while the other website had 4 million visitors. In the UK, they had around 500,000 and 50,000 visitors, respectively.

This week, politicians in the UK announced plans for a law that criminalizes the creation of nonconsensual deepfakes. Under the law, which is yet to be passed, people could face an unlimited fine if they create deepfakes to “cause alarm, humiliation, or distress to the victim.” This builds on previous provisions that make it illegal for people in the UK to share sexualized deepfakes.

“While it’s unclear if these platforms have been ordered to block UK access or have done so proactively due to the recent criminalization, it shows legislation can make a meaningful difference in removing the legal ambiguity that many deepfake pornography platforms use as cover for the clear ethical harms they cause,” Henry Ajder, an AI and deepfake expert, tells WIRED. Ajder adds that search engines and hosting providers around the world should be doing more to limit the spread and creation of harmful deepfakes.

While the two websites can still be accessed in the UK using a VPN, the restrictions are a sign that constant pressure—from lawmakers, tech companies, and campaigners—can make deepfake porn harder to access and create. “Of course, people will be able to use VPN to access these websites and apps, but that introduces friction,” Durham University’s McGlynn says. “It introduces a message that there’s something wrong and harmful about this material such that you have to use a VPN to access it.”

“Hopefully,” McGlynn adds, “this can show other governments around the world that if we take steps, we could actually reduce the prevalence \[of\] and easy access to deepfake sexual abuse material.”

The Biggest Deepfake Porn Website Is Now Blocked in the UK

By Deeba Ahmed
Shadowboxing in Search Results: Tuta Mail De-ranked and Disappearing on Google!
This is a post from HackRead.com Read the original post: Tuta Mail (Tutanota) Accuses Google of Censoring Its Search Results

Is Google hiding Tuta Mail from search results? Here’s the controversy surrounding Tuta Mail’s search ranking and dig deeper into the potential violation of Europe’s DMA. Learn about algorithmic bias, the importance of search transparency, and how users can navigate a potentially unfair digital marketplace.

For many users seeking privacy-focused email solutions, the popular open-source encrypted email service Tuta Mail (previously Tutanota) is a great alternative to mainstream providers. However, the company recently raised concerns about its visibility in Google search results. 

****Tuta Mail Being De-ranked on Google?****

Hanover, Germany-based Tuta Mail, the world’s second-largest secure email service provider, isn’t appearing on Google for search terms like “encrypted email” or “secure email”. Moreover, a dramatic drop in search ranking for “Tutanota login” is observed, suggesting a potential violation of the European Digital Markets Act (DMA).

What happens when Tutanota login is typed in Google (Screenshot: Hackread.com)

According to Tuta Mail’s blog, its users in Germany cannot view Tuta’s website as the first result but only on their Android app on Google Play. It may have severe implications for Tuta’s business, despite being a Google-specific issue, because on other search engines, like Bing or DuckDuckGo, there’s no such issue. This lack of search visibility for relevant keywords can hinder Tuta’s ability to compete in the email service market and put them at a disadvantage. 

****Why Might Google Be De-ranking Tuta Mail?****

Tuta Mail’s lower ranking in Google search results could be due to various factors, including relevance, algorithmic bias, and technical issues. Google’s search algorithms prioritize user experience, and other email service providers may have higher relevance scores. Technical glitches or indexing problems can cause temporary website disappearance from search results, but this is highly unlikely for an established service like Tuta Mail. It is a complex issue and Google must address it to ensure transparency and user awareness. 

What’s more concerning is that it violates the DMA, which promotes fair competition for privacy-conscious companies. The DMA being a new regulation, is evolving its enforcement of search engine practices. If Tuta Mail has evidence of Google manipulating search results, they could file a complaint.

****Not the First Time for Tuta:****

Tuta Mail has been facing blockages from multiple sides. In 2022, Hackread.com reported Microsoft blocking Tutanota/Tuta Mail email addresses from registering for Microsoft Teams accounts, despite the service having over 2 million registered users.

Russia also blocked Tuta in certain parts of the country in February 2020 without notifying the team about the reason whereas the service has been blocked in Egypt since October 2019.

In a comment to Hackread.com, Matthias Pfau, co-founder of Tuta Mail, criticized Google’s monopoly over search engine results, specifically its impact on determining what to show and what not to show.

> _“This issue is limited to Google only. But due to Google’s search dominance in Europe and North America, the drop we see in search results directly affects our business: When potential users are not able to find our website on Google, it means we lose business. Google must stop this unfair limitation of showing our website in search results immediately. We have tried to contact Google directly, but since this did not work, we have to make the issue public.”_
> 
> Matthias Pfau, co-founder of Tuta Mail

1.  How Internet Censorship Affects You – Pros & Cons
2.  Google to Delete Inactive Gmail Accounts From Today
3.  Top 10 worst countries for Internet freedom & censorship
4.  Simple Yet Vital Tips to Send Documents Securely via Email
5.  Google Incognito Mode: New Disclaimer Reveals Data Tracking

Tuta Mail (Tutanota) Accuses Google of Censoring Its Search Results

Securing the presidential election requires vigilance and hardened cybersecurity defenses.

Shawn Henry, Chief Security Officer, CrowdStrike

April 19, 2024

3 Min Read

Source: thinkx2 via Alamy Stock Photo

COMMENTARY

Foreign adversaries have attempted to disrupt the US elections for years through various methods. This includes espionage and "hack and leak" campaigns that steal sensitive data and later amplify it in public forums. Today, generative AI (GenAI) is altering the battlefield for attacks, and in the modern information ecosystem where misinformation and disinformation can spread rapidly, it has the potential to transform geopolitics.

Throughout my 24-year career with the FBI, I witnessed sophisticated adversaries attempt to sow confusion and cripple networks, as cyber-threat actors developed tools and tactics to disrupt businesses, governments, and more. The malicious use and proliferation of GenAI in 2024 presents one of the toughest challenges we'll face in an election year. 

**Adversaries Continue on Their Path to Disrupt and Dismantle**

Nation-state adversaries affiliated with and tied to the motivations of foreign governments have the resources to scale operations, and pose a constant threat to democracy. As we've seen previously, it's likely that threat actors from China, Russia, and Iran (charged for sending fake, intimidating emails to US voters in 2020) will seek to interfere with the 2024 US election.

Adversaries may seek to target actual election infrastructure itself, including the hardware and software used to tally and transmit votes, as well as political campaign assets. While some actors have leveraged information operations, generative AI is poised to increase the attractiveness of this malicious activity. With GenAI, it is easier than ever for threat actors to create content and influence narratives that support their underlying goals and objectives. This, in turn, can undermine public confidence and perceptions of political issues, parties, and candidates.

In fact, we're already starting to see the impacts. Threat actors from China recently weaponized deepfakes ahead of Taiwan's election, aiming to increase the voting public's confidence in candidates more diplomatic to China. Fabricated information campaigns stemming from state-nexus entities will not be novel in 2024; however, generative AI will make deciphering what is real or not infinitely more difficult. 

The rise of GenAI has also lowered the barrier of entry for virtually anyone to interfere with elections. Less sophisticated hackers or hacktivists with a specific geopolitical goal may be able to create high-quality disinformation campaigns with relative ease. We've already seen a local magician make global headlines this year by using AI to create fake robocalls, and it's only April.

**Countering These Growing Threats**

So, what can be done? When it comes to protecting the disparate election systems, it is critical to apply a risk-informed approach. At the heart of this is hardening environments to protect systems and stop breaches, 24/7 continuous monitoring of systems, and deep visibility into critical areas of risk, including endpoints, cloud, and identity. Employing both threat hunting and threat intelligence is equally as important, as these tools help to proactively protect against adversaries who may attempt to penetrate networks.

State and local elections administration entities have improved their security over the past several election cycles. So too have political parties and campaign entities. But additional attention and investment is warranted.

With respect to information operations, we must continue to raise awareness. Defending against this threat starts with vigilance from everyone. Citizens must be on alert and validate the origin of information they are consuming, consider the source's political stance and objective, and attempt to validate information through trusted sources prior to amplifying it. All Americans have a crucial role to play in critically analyzing the information they are getting and, more importantly, sharing 

Social media companies and GenAI companies should work to detect and prevent threat actors' use of their tools and platform. At a minimum this means cooperating with each other where appropriate and collaborating with cybersecurity companies and IT providers that have experience tracking these groups.

In 2024, voters in all 50 states and across 55 countries will participate in elections, providing numerous opportunities for adversaries with various motivations to disrupt and dismantle confidence in democracy. With proper awareness, preparation, and cybersecurity best practices in place, we can take a big step forward in defending democracy in the digital age. Failure to do so could be catastrophic.

**About the Author(s)**

Chief Security Officer, CrowdStrike

Shawn Henry serves as chief security officer and is one of the company's longest tenured executive leaders, having joined in 2012 after retiring from the FBI senior executive service. In Henry’s role, he oversees all security aspects of CrowdStrike, including the company's information security, business continuity and resiliency, and risk reduction programs, as well as the physical security of CrowdStrike's global facilities, personnel, executive protection, and corporate events. Prior to joining CrowdStrike, Shawn oversaw half of the FBI's investigative operations as Executive Assistant Director, including all FBI criminal and cyber investigations worldwide, international operations, and the FBI's critical incident response to major investigations and disasters.

AI Lowers Barrier for Cyber-Adversary Manipulation in 2024 Election

Malformed DOS paths in file-naming nomenclature in Windows could be used to conceal malicious content, files, and processes.

Source: Robert Adrian Hillman via Alamy Stock Vector

BLACK HAT ASIA – Singapore – A known issue associated with the DOS-to-NT path conversion process in Windows opens up significant risk for businesses by allowing attackers to gain rootkit-like post-exploitation capabilities to conceal and impersonate files, directories, and processes.

That's according to Or Yair, security researcher at SafeBreach, who outlined the issue during a session here this week. He also detailed four different vulnerabilities related to the issue, which he dubbed "MagicDot" - including a dangerous remote code-execution bug that can be triggered simply by extracting an archive.

**Dots & Spaces in DOS-to-NT Path Conversion**

The MagicDot group of problems exist thanks to the way that Windows changes DOS paths to NT paths.

When users open files or folders on their PCs, Windows accomplishes this by referencing the path where the file exists; normally, that's a DOS path that follows the "C:\\Users\\User\\Documents\\example.txt" format. However, a different underlying function called NtCreateFile is used to actually perform the operation of opening the file, and NtCreateFile asks for an NT path and not a DOS path. Thus, Windows converts the familiar DOS path visible to users into an NT path, prior to calling NtCreateFile to enable the operation.

The exploitable problem exists because, during the conversion process, Windows automatically removes any periods from the DOS path, along with any extra spaces at the end. Thus, DOS paths like these:

*   C:\\example\\example<space>    
    

are all converted to "\\??\\C:\\example\\example" as an NT path.

Yair discovered that this automatic stripping out of erroneous characters could allow attackers to create specially crafted DOS paths that would be converted to NT paths of their choice, which could then be used to either render files unusable or to conceal malicious content and activities.

**Simulating an Unprivileged Rootkit**

The MagicDot issues first and foremost create the opportunity for a number of post-exploitation techniques that help attackers on a machine maintain stealth.

For instance, it's possible to lock up malicious content and prevent users, even admins, from examining it. "By placing a simple trailing dot at the end of a malicious file name or by naming a file or a directory with dots and/or spaces only, I could make all user-space programs that use the normal API inaccessible to them ... users would not be able to read, write, delete, or do anything else with them," Yair explained in the session.

Then, in a related attack, Yair found that the technique could be used to hide files or directories within archive files.

"I simply ended a file name in an archive with a dot to prevent Explorer from listing or extracting it," Yair said. "As a result, I was able to place a malicious file inside an innocent zip — whoever used Explorer to view and extract the archive contents was unable to see that file existed inside."

A third attack method involves masking malicious content by impersonating legitimate file paths.

"If there was a harmless file called 'benign,' I was able to \[use DOS-to-NT path conversion\] to create a malicious file in the same directory \[also named\] benign," he explained, adding that the same approach could be used to impersonate folders and even broader Windows processes. "As a result, when a user reads the malicious file, the content of the original harmless file would be returned instead," leaving the victim none the wiser that they were actually opening malicious content.

Taken together, manipulating MagicDot paths can grant adversaries rootkit-like abilities without admin privileges, explained Yair, who published detailed technical notes on the attack methods in tandem with the session.

"I found I could hide files and processes, hide files in archives, affect prefetch file analysis, make Task Manager and Process Explorer users think a malware file was a verified executable published by Microsoft, disable Process Explorer with a denial of service (DoS) vulnerability, and more," he said — all without admin privileges or the ability to run code in the kernel, and without intervention in the chain of API calls that retrieve information.

"It's important that the cybersecurity community recognize this risk and consider developing unprivileged rootkit detection techniques and rules," he warned.

**A Series of "MagicDot" Vulnerabilities**

During his research into the MagicDot paths, Yair also managed to uncover four different vulnerabilities related to the underlying issue, three of them since patched by Microsoft.

One remote code execution (RCE) vulnerability (CVE-2023-36396, CVSS 7.8) in Windows's new extraction logic for all newly supported archive types allows attackers to craft a malicious archive that would write anywhere they choose on a remote computer once extracted, leading to code execution.

"Basically, let's say you upload an archive to your GitHub repository advertising it as a cool tool available for download," Yair tells Dark Reading. "And when the user downloads it, it's not an executable, you just extract the archive, which is considered a completely safe action with no security risks. But now, the extraction itself is able to run code on your computer, and that is seriously wrong and very dangerous."

A second bug is an elevation of privilege (EoP) vulnerability (CVE-2023-32054, CVSS 7.3) that allows attackers to write into files without privileges by manipulating the restoration process of a previous version from a shadow copy.

The third bug is Process Explorer unprivileged DOS for anti-analysis bug, for which CVE-2023-42757 has been reserved, with details to follow. And the fourth bug, also an EoP issue, allows unprivileged attackers to delete files. Microsoft confirmed that the flaw led to "unexpected behavior" but hasn't yet issued a CVE or a fix for it.

"I create a folder inside the demo folder called …<space> and inside, I write a file named c.txt," Yair explained. "Then when an administrator attempts to delete the …<space> folder, the entire demo folder is deleted instead."

**Potentially Wider "MagicDot" Ramifications**

While Microsoft addressed Yair's specific vulnerabilities, the DOS-to-NT path conversion auto-stripping of periods and spaces persists, even though that's the root cause of the vulnerabilities.

"That means there might be many more potential vulnerabilities and post-exploitation techniques to find using this issue," the researcher tells Dark Reading. "This issue is still exists and can lead to many more issues and vulnerabilities, which can be much more dangerous than the ones we know about."

He adds that the problem has ramifications beyond Microsoft.

"We believe the implications are relevant not only to Microsoft Windows, which is the world's most widely used desktop OS, but also to all software vendors, most of whom also allow known issues to persist from version to version of their software," he warned in his presentation.

Meanwhile, software developers can make their code safer against these types of vulnerabilities by utilizing NT paths rather than DOS paths, he noted.

"Most high-level API calls in Windows support NT paths," Yair said in his presentation. "Using NT paths avoids the conversion process and ensures the provided path is the same path that is being actually operated on."

For businesses, security teams should create detections that look for rogue periods and spaces within file paths.

"There are pretty easy detections that you can develop for these, to look for files or directories, that have trailing dots or spaces in them, because if you find those, on your computer, it means that someone did it on purpose because it's not that easy to do," Yair tells Dark Reading. "Normal users can't just create a file with ends with a dot or space, Microsoft will prevent that. Attackers will need to use a lower API that is closer to the kernel, and will need some expertise to accomplish this."

**About the Author(s)**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

'MagicDot' Windows Weakness Allows Unprivileged Rootkit Activity

The tech giant tosses together a word salad of today's business drivers — AI, cloud-native, digital twins — and describes a comprehensive security strategy for the future, but can the company build the promised platform?

Source: Peach Shutterstock via Shutterstock

The cybersecurity industry has no shortage of problems: Attackers are using automation to shorten their time to exploit, patching software is burdensome, establishing defenses such as segmentation remains difficult, and a shortage of cybersecurity-skilled workers holds back efforts in all of these areas.

No wonder, then, that Cisco has decided to launch an AI-powered, distributed security platform for protecting cloud workloads and artificial intelligence (AI) systems from cybersecurity threats. Dubbed Hypershield, the platform will push security out to the edge, using AI-augmented agents to maintain security controls around every workload in the data center and even distributed, connected devices. Cisco says the platform will be able to patch environments automatically, test software updates within the environment using simulated systems known as digital twins, and block attacks by detecting anomalous behavior.

Hyperbole was not in short supply, and "reimagined" seemed to be the word of the day.

Jeetu Patel, executive vice president and general manager of Cisco's security and collaboration division, called it "one of the largest platform shifts that we've experienced during our lifetimes."

"For the past gazillion years, when we've looked at security, the advantage has always been on the side of the adversary," Patel said during a press conference announcing Hypershield. "We are now approaching an era ... where ... because \[of this platform\], you might have a world where you might have an advantage as a defender, and wouldn't that be a wonderful world to live in."

Cybersecurity is certainly a field that could benefit from using AI for augmentation or as an assistant, and pushing security to the distributed edge — closer to the devices to be secured — can help simplify some aspects of vast networks that need to be secured.

The company's choice of technologies makes sense, says David Holmes, a principal analyst with Forrester Research. By using eBPF, a technology that allows sandboxed programs to run in a privileged context, pieces of the workload can be instrumented, and data processing units (DPUs) allow efficient processing of data using high-bandwidth network interfaces.

"They are describing a more modern approach to building a private cloud data center architecture, and that’s good," Holmes says. "eBPF for automation \[and\] security, container-like workloads — their DPUs — overall, this is good for the industry if they pull it off."

**Digital Twins Allow Automated Patching**

Craig Connors, chief technology officer of Cisco's security business group, demonstrated how a workload or application could be automatically patched and run in parallel using digital-twin technology to test the stability and correctness of the updated software. Digital twins are simulations — originally used in product development and manufacturing — that allow software engineers to test and observe a version of a device or application.

If patched code passes all tests and satisfies policies, then it can be promoted to production, Connors said during the demonstration.

"What we've done is we've essentially introduced the digital twin into every enforcement point that we deploy," Connors stated. "So we're actually bringing CI/CD \[continuous integration and continuous delivery\] to the embedded world by running the end-of-the-promotion pipeline as a digital twin on every single enforcement point for every single customer in the world in a transparent way. That allows us to test every possible combination that could happen in your real environment everywhere."

While the company will start with Linux environments, Cisco hinted at future plans to support other operating systems.

The same digital-twin approach can be applied to developing segmentation policies for networks of devices and workloads, according to Connors. The AI assistant built into the Hypershield platform could recommend microsegmentation policies and give a confidence score that each policy would behave well inside a given environment.

"Imagine if AI wasn't just recommending microsegmentation policies, but it was modeling them in a digital twin of your environment, and telling you exactly how it tested those policies to make sure they were correct before it recommended them to you," Connors said. "So we're really trying to bring that trust aspect in and not just 'AI bomb' you with recommendations."

**Distributed Exploit Protection**

Cisco says the platform will also protect against exploits in real time by using threat intelligence to inform anomaly detection and response. Because companies never know which vulnerabilities will be picked up by an attacker, the system allows all high-impact vulnerabilities to be treated the same.

This approach benefits companies with legacy hardware and software that has reached end of life and is no longer receiving updates, according to Connors.

"There are cases where we can never patch. ... Let's say the software's end of life, but my business still relies on it and a critical vulnerability exists," Connors said. "So while these are intended to be short-lived patches to bridge that gap between that availability and patch deployment and then we'll automatically pull back these distributed shields, it is potentially feasible that you may want to run this for the life of the application to continue protecting you against \[exploitation\]."

Having the vision and individual technologies is a good first step, but like the platform managing driver-assist features in cars, the trick is how it all comes together, says Jon Oltsik, analyst emeritus at Enterprise Strategy Group. Coordinating the pieces across multiple systems, rather than looking at each one in isolation — as well as figuring out "normal" activity — and then responding will be tricky.

"It's a good goal, but a lot of things need to come together to make it happen, including user buy-in," he says. "AI-based security must go through rigorous testing and be proven in the field before security professionals will trust it."

Cisco has promised the platform will be generally available by August.

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Cisco's Complex Road to Deliver on Its Hypershield Promise

CISA advisory warns of critical ICS device flaws, but a lack of available fixes leaves network administrators on defense to prevent exploits.

Source: rapsian sawangphon via Alamy Stock Photo

A security advisory issued this week by the Cybersecurity and Infrastructure Security Agency (CISA) alerts administrators of vulnerabilities in two industrial control systems devices — Unitronics Vision Series PLCs and Mitsubishi Electric MELSEC iQ-R Series.

CISA warned that the Unitronics Vision Series PLC controller is open to remote exploit due to its storage of passwords in a recoverable format. This vulnerability (CVE-2024-1480) was assigned a CVSS score of 8.7.

Unitronics has not responded to, or worked with, the agency to mitigate the issue, leaving networks with these devices open to cyberattack, according to CISA. The advisory recommends ensuring the controllers are not connected to the Internet, isolating them from business networks, protecting the devices behind firewalls, and using secure methods, like virtual private networks (VPNs), for remote access.

The remaining ICS vulnerabilities impact the Mitsubishi Electric Corporation MELSEC iQ-R CPU Module. A design flaw in the CPU, tracked under CVE-2021-20599, has been assigned a CVSS score of 9.1. The unit transmits passwords in cleartext, which are easily intercepted by adversaries.

The Mitsubishi MELSEC CPUs also harbor a trio of reported flaws that could allow a threat actor to compromise usernames, access the device, and deny access to legitimate users. These include: exposure of sensitive information (CVE-2021-20594, CVSS 5.9); insufficiently protected credentials (CVE-2021-20597, CVSS 7.4); and a restrictive account lockout mechanism (CVE-2021-20598, CVSS 3.7).

Mitsubishi is working to provide mitigations and workarounds for the issues. However, systems with these devices are unable to be updated with a fix, according to CISA. The agency advises administrators with these devices in their networks to shore up defenses with firewalls, remote access limitations, and IP address restrictions.

"Mitsubishi Electric has released the fixed version ... but updating the product to the fixed version is not available," the advisory said. "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability."

**About the Author(s)**

ICS Network Controllers Open to Remote Exploit, No Patches Available

Existing AI technology can allow hackers to automate exploits for public vulnerabilities in minutes flat. Very soon, diligent patching will no longer be optional.

Source: Rokas Tenys via Shutterstock

AI agents equipped with GPT-4 can exploit most public vulnerabilities affecting real-world systems today, simply by reading about them online.

New findings out of the University of Illinois Urbana-Champaign (UIUC) threaten to radically enliven what's been a somewhat slow 18 months in artificial intelligence (AI)-enabled cyber threats. Threat actors have thus far used large language models (LLMs) to produce phishing emails, along with some basic malware, and to aid in the more ancillary aspects of their campaigns. Now, though, with only GPT-4 and an open source framework to package it, they can automate the exploitation of vulnerabilities as soon as they hit the presses.

"I'm not sure if our case studies will help inform how to stop threats," admits Daniel Kang, one of the researchers. "I do think that cyber threats will only increase, so organizations should strongly consider applying security best practices."

**GPT-4 vs. CVEs**

To gauge whether LLMs could exploit real-world systems, the team of four UIUC researchers first needed a test subject.

Their LLM agent consisted of four components: a prompt, a base LLM, a framework — in this case ReAct, as implemented in LangChain — and tools such as a terminal and code interpreter.

The agent was tested on 15 known vulnerabilities in open source software (OSS). Among them: bugs affecting websites, containers, and Python packages. Eight were given "high" or "critical" CVE severity scores. There were 11 that were disclosed past the date at which GPT-4 was trained, meaning this would be the first time the model was exposed to them.

With only their security advisories to go on, the AI agent was tasked with exploiting each bug in turn. The results of this experiment painted a stark picture.

Of the 10 models evaluated — including GPT-3.5, Meta's Llama 2 Chat, and more — nine could not hack even a single vulnerability.

GPT-4, however, successfully exploited 13, or 87% of the total.

It only failed twice for utterly mundane reasons. CVE-2024-25640, a 4.6 CVSS-rated issue in the Iris incident response platform, survived unscathed because of a quirk in the process of navigating Iris' app, which the model couldn't handle. Meanwhile, the researchers speculated that GPT-4 missed with CVE-2023-51653 — a 9.8 "critical" bug in the Hertzbeat monitoring tool because its description is written in Chinese.

As Kang explains, "GPT-4 outperforms a wide range of other models on many tasks. This includes standard benchmarks (MMLU, etc.). It also seems that GPT-4 is much better at planning. Unfortunately, since OpenAI hasn't released the training details, we aren't sure why."

**GPT-4 Good**

As threatening as malicious LLMs might be, Kang says, "At the moment, this doesn't unlock new capabilities an expert human couldn't do. As such, I think it's important for organizations to apply security best practices to avoid getting hacked, as these AI agents start to be used in more malicious ways."

If hackers start utilizing LLM agents to automatically exploit public vulnerabilities, companies will no longer be able to sit back and wait to patch new bugs (if ever they were). And they might have to start using the same LLM technologies as well as their adversaries will.

But even GPT-4 still has some ways to go before it's a perfect security assistant, warns Henrik Plate, security researcher for Endor Labs. In recent experiments, Plate tasked ChatGPT and Google's Vertex AI with identifying samples of OSS as malicious or benign, and assigning them risk scores. GPT-4 outperformed all other models when it came to explaining source code and providing assessments for legible code, but all models yielded a number of false positives and false negatives.

Obfuscation, for example, was a big sticking point. "It looked to the LLM very often as if \[the code\] was deliberately obfuscated to make a manual review hard. But often it was just reduced in size for legitimate purposes," Plate explains.

"Even though LLM-based assessment should not be used instead of manual reviews," Plate wrote in one of his reports, "they can certainly be used as one additional signal and input for manual reviews. In particular, they can be useful to automatically review larger numbers of malware signals produced by noisy detectors (which otherwise risk being ignored entirely in case of limited review capabilities)."

**About the Author(s)**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Tag

#git