{WARNING} Cybersecurity vulnerabilities/flaws: Ledger exploit (10.08.20).

[TheBeardedBaby]

This is a huge one.

Over 40 Drivers Could Let Hackers Install Persistent Backdoor On Windows PCs
 

If you own a device, or a hardware component, manufactured by ASUS, Toshiba, Intel, NVIDIA, Huawei, or other 15 other vendors listed below, you're probably screwed.
A team of security researchers has discovered high-risk security vulnerabilities in more than 40 drivers from at least 20 different vendors that could allow attackers to gain most privileged permission on the system and hide malware in a way that remains undetected over time, sometimes for years.

...

All the vulnerable drivers, as listed below, uncovered by the researchers, have been certified by Microsoft.
American Megatrends International (AMI)
ASRock
ASUSTeK Computer
ATI Technologies (AMD)
Biostar
EVGA
Getac
GIGABYTE
Huawei
Insyde
Intel
Micro-Star International (MSI)
NVIDIA
Phoenix Technologies
Realtek Semiconductor
SuperMicro
Toshiba

"Some vulnerable drivers interact with graphics cards, network adapters, hard drives, and other devices," researchers explain. "Persistent malware inside these devices could read, write, or redirect data stored, displayed, or sent over the network. Likewise, any of the components could be disabled as part of a DoS or ransomware attack."

Device driver flaws can be more dangerous than other application vulnerabilities because it allows an attacker access to the "negative" firmware rings that lie beneath the operating system and maintain persistence on the device, even if the operating system is completely reinstalled, just like in case of LoJax malware.

Researchers have reported these vulnerabilities to the affected vendors, of which some, including Intel and Huawei, have already released patch updates and issued a security advisory.

Besides this, researchers have also promised to soon release a script on GitHub that would help users find wormhole drivers installed on their systems, along with proof-of-concept code, video demonstrations, and links to vulnerable drivers and tools.

[1713910652]

1713910652

[1713910652]

1713910652

[TheBeardedBaby]

4 New BlueKeep-like 'Wormable' Windows Remote Desktop Flaws Discovered

Every day there is a new threat. Keep your machine updated!

Windows operating system contains four new critical wormable, remote code execution vulnerabilities in Remote Desktop Services, similar to the recently patched 'BlueKeep' RDP vulnerability.

Discovered by Microsoft's security team itself, all four vulnerabilities, CVE-2019-1181, CVE-2019-1182, CVE-2019-1222, and CVE-2019-1226, can be exploited by unauthenticated, remote attackers to take control of an affected computer system without requiring any user interaction.

Good that they found the vulnerabilities before the hackers.

Besides this, Microsoft also says that the company has found "no evidence that these vulnerabilities were known to any third party," or being exploited in the wild.

    "It is important that affected systems are patched as quickly as possible because of the elevated risks associated with wormable vulnerabilities like these," Microsoft strongly recommended.


If left unpatched, these security vulnerabilities could allow attackers to spread wormable malware in a similar way as the infamous WannaCry and NotPetya malware was spread across the globe in 2017.

[Baofeng]

If you are using Libre Office you should be very careful about what files you are opening.
Just Opening A Document in LibreOffice Can Hack Your Computer (Unpatched)

You should be extra careful about what document files you open using the LibreOffice software over the next few days.
That's because LibreOffice contains a severe unpatched code execution vulnerability that could sneak malware into your system as soon as you open a maliciously-crafted document file.

There is no fix yet but in the next few days the LibreOffice team will come out with an patch. Until then stay away from any suspicious files.

They have patched this vulnerabilities, unfortunately, it wasn't enough, so everyone needs to update patched version 6.2.6/6.3.0.

Apparently, the patch for this vulnerability was insufficient, as The Hacker News also reported late last month, which allowed two separate security researchers to bypass the patch and re-enable the attack by exploiting two new vulnerabilities, as explained below:

CVE-2019-9850: Discovered by Alex Inführ, the vulnerability in LibreOffice exists due to insufficient URL validation that allows malicious attackers to bypass the protection added to patch CVE-2019-9848 and again trigger calling LibreLogo from script event handlers.

CVE-2019-9851: Discovered by Gabriel Masei, this flaw resides in a separate feature where documents can specify pre-installed scripts, just like LibreLogo, which can be executed on various global script events such as document-open, etc.

https://thehackernews.com/2019/08/libreoffice-patch-update.html

[TheBeardedBaby]

Let me bump this thread with not so good news for the owners of Intel processors.

NetCAT: New Attack Lets Hackers Remotely Steal Data From Intel CPUs

Unlike previous side-channel vulnerabilities disclosed in Intel CPUs, researchers have discovered a new flaw that can be exploited remotely over the network without requiring an attacker to have physical access or any malware installed on a targeted computer.
Dubbed NetCAT, short for Network Cache ATtack, the new network-based side-channel vulnerability could allow a remote attacker to sniff out sensitive data, such as someone's SSH password, from Intel's CPU cache.

And here is the solution from Intel:

In its advisory, Intel has acknowledged the issue and recommended users to either completely disable DDIO or at least RDMA to make such attacks more difficult, or otherwise suggested to limit direct access to the servers from untrusted networks.

For more info check the source publication.

[TheBeardedBaby]

A new warning to all of you who are using iPhones and have 3rd-party keyboard installed.
You can can loose your passwords,private keys and fund if you keep them on your mobile. Read the article!!
 
iOS 13 Bug Lets 3rd-Party Keyboards Gain 'Full Access' — Even When You Deny

Following the release of iOS 13 and iPadOS earlier this week, Apple has issued an advisory warning iPhone and iPad users of an unpatched security bug impacting third-party keyboard apps.

On iOS, third-party keyboard extensions can run entirely standalone without access to external services and thus, are forbidden from storing what you type unless you grant "full access" permissions to enable some additional features through network access.
...
However, in the brief security advisory, Apple says that an unpatched issue in iOS 13 and iPadOS could allow third-party keyboard apps to grant themselves "full access" permission to access what you are typing—even if you deny this permission request in the first place.

It should be noted that the iOS 13 bug doesn't affect Apple's built-in keyboards or third-party keyboards that don't make use of full access.

...
Instead, the bug only impacts users who have third-party keyboard apps—such as popular Gboard, Grammarly, and Swiftkey—installed on their iPhones or iPads, which are designed to request full access from users.

Though having full access allows app developers to capture all keystroke data and everything you type, it's worth noting that likely no reputable third-party keyboard apps would by default abuse this issue.

Even if that doesn't satisfy you, and you want to check if any of the installed third-party keyboards on your iPhone or iPad has enabled full access without your knowledge by exploiting this bug, you can open the Settings → General → Keyboard → Keyboards.

Apple assured its users that the company is already working on a fix to address this issue, which it plans to release in its upcoming software update.

Until Apple comes up with a fix, you can mitigate this issue by temporarily uninstalling all third-party keyboards from your device just to be on the safer side.

Link to the source.

The OP is updated.

[TheBeardedBaby]

Those warnings never end,if you use Chrome update your browser ASAP.
Read more below or follow the source link under the quote.

New Chrome 0-day Bug Under Active Attacks – Update Your Browser Now!

Attention readers, if you are using Chrome on your Windows, Mac, and Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today.
With the release of Chrome 78.0.3904.87, Google is warning billions of users to install an urgent software update immediately to patch two high severity vulnerabilities, one of which attackers are actively exploiting in the wild to hijack computers.
Without revealing technical details of the vulnerability, the Chrome security team only says that both issues are use-after-free vulnerabilities, one affecting Chrome's audio component (CVE-2019-13720) while the other resides in the PDFium (CVE-2019-13721) library.

The use-after-free vulnerability is a class of memory corruption issues that allows corruption or modification of data in the memory, enabling an unprivileged user to escalate privileges on an affected system or software.
Thus, both flaws could enable remote attackers to gain privileges on the Chrome web browser just by convincing targeted users into visiting a malicious website, allowing them to escape sandbox protections and run arbitrary malicious code on the targeted systems.

The source: https://thehackernews.com/2019/11/chrome-zero-day-update.html

[TheBeardedBaby]

To all the Linux and Mac OS users out there , there's a new vulnerability in Sudo utility that can allow users without privileges to run administratrative commands.
Check if  "pwfeedback" option is enabled in the sudoers configuration file, and disable it immediately.

Find more in the article below:
Sudo Bug Lets Non-Privileged Linux and macOS Users Run Commands as Root

[akirasendo17]

Sudo Bug Lets Non-Privileged Linux and macOS Users Run Commands as Rootnew
Added> 04.02.20

sudo should not be given to a user, or don't need to be run everytime, that is why mostly of users in example in a company should have only standard user
because if a user have sudo previlleges he can run or install anything even with an untrusted source, mostly if you install ubuntu, or other linux os there is no need to put a lot of software because its already install
what you just need, is an update and and your done.

[TheBeardedBaby]

I'm quoting my post from the Wallets software section, so I can add it to the list.

I came across this news and decide to share it with you guys so people should be aware if their funds get locked by ledger and cannot be spent. You guys need to update the hardware wallet to fix it.
I do not own Ledger and I cannot 100% confirm the legitimacy of the source website but seems that the guy who found the vulnerability actually posted it on Twitter.

In brief
A vulnerability in Ledger's hardware wallets allows a request for an altcoin transaction to actually request the movement of Bitcoin.
The exploit was reportedly disclosed to Ledger back in 2019.
Ledger said it's because the firm wanted "to avoid a situation where user funds would be locked and users unable to spend their funds.”

An exploit in Ledger’s crypto hardware wallets could allow malicious actors to steal Bitcoin, according to a report published by Liquality developer Mohammed Nokhbeh on Tuesday.

The attack works by the bad actor creating a transaction that looks like an altcoin payment (a coin that isn’t Bitcoin) when it actually takes Bitcoin out of the wallet instead.

“An attacker can exploit this method to transfer Bitcoin while the user is under the impression that a transaction of another, less valuable altcoin (e.g. Litecoin, Testnet Bitcoins, Bitcoin Cash, etc.) is being executed,” wrote Nokhbeh.
This is worrying because the user thinks that they’re handing out 0.01 of an altcoin, which could be far less valuable than 0.01 Bitcoin, for instance.

"A new version of the Bitcoin app will be released today, with an update that will display a warning and prompt for confirmation when an unexpected path is used—therefore solving this issue," said a Ledger spokesperson (who later confirmed that the fix is now live).

Source > https://decrypt.co/37651/ledger-exploit-makes-you-spend-bitcoin-instead-of-altcoins
Source, the guy who found the vulnerability > https://monokh.com/posts/ledger-app-isolation-bypass

[Aveatrex]

In addition to this recent flaw, a part of their emai/users details got leaked: https://twitter.com/Ledger/status/1288452973811703810

If you are concerned, you probably received an email from them. Ledger is really screwing up more often recently..

[Lucius]

TheBeardedBaby, Ledger is fix this vulnerability just one day after monokh announced publicly what exactly it was about - I can confirm that Bitcoin app is updated on 2020-08-05 - more info here : https://donjon.ledger.com/lsb/014/

Aveatrex, about 1 million e-mails are stolen, but Ledger say hacker is got users data (e-mail, first+last name, full home address, and phone number) for 9500 Ledger users/buyers. All users received a general warning, with the difference that these 9500 users received further clarification.

[TheBeardedBaby]

TheBeardedBaby, Ledger is fix this vulnerability just one day after monokh announced publicly what exactly it was about - I can confirm that Bitcoin app is updated on 2020-08-05 - more info here : https://donjon.ledger.com/lsb/014/

Aveatrex, about 1 million e-mails are stolen, but Ledger say hacker is got users data (e-mail, first+last name, full home address, and phone number) for 9500 Ledger users/buyers. All users received a general warning, with the difference that these 9500 users received further clarification.

Thanks for your clarification, I do not own any Ledger products, so I am not so familiar with the usage. If only the Bitcoin app is supposed to be updated, then the issue is solved if you are keeping your device up to date.
News like this are ruining the reputation of the hardware wallets in general for the public who have no idea how they really operate.

[Lucius]

Thanks for your clarification, I do not own any Ledger products, so I am not so familiar with the usage.

No problem, I have Nano S and X and I have to admit that as their user I am not at all happy that things like this are happening to them. However, I was not directly affected by the last vulnerability because I do not make altcoins transactions. I was more worried about data theft, which should not have happened to such a company. It should only be noted that the same vulnerability was discovered on Trezor, and it is fixed with new firmware the same day Ledger did the same.

I agree that reputation builds over the years, but it can be completely lost overnight - it’s a hard road ahead of Ledger after all this.