• Search for:
    13Dec, 2023
    50K WordPress sites exposed to RCE attacks by critical bug in backup plugin

    A critical severity vulnerability in a WordPress plugin with more than 90,000 installs can let attackers gain remote code execution to fully compromise vulnerable websites.

    Known as Backup Migration, the plugin helps admins automate site backups to local storage or a Google Drive account.

    The security bug (tracked as CVE-2023-6553 and rated with a 9.8/10 severity score) was discovered by a team of bug hunters known as Nex Team, who reported it to WordPress security firm Wordfence under a recently launched bug bounty program.

    It impacts all plugin versions up to and including Backup Migration 1.3.6, and malicious actors can exploit it in low-complexity attacks without user interaction.

    CVE-2023-6553 allows unauthenticated attackers to take over targeted websites by gaining remote code execution through PHP code injection via the /includes/backup-heart.php file.

    “This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated threat actors to easily execute code on the server,” Wordfence said on Monday.

    “By submitting a specially-crafted request, threat-actors can leverage this issue to include arbitrary, malicious PHP code and execute arbitrary commands on the underlying server in the security context of the WordPress instance.”

    In the /includes/backup-heart.php file used by the Backup Migration plugin, an attempt is made to incorporate bypasser.php from the BMI_INCLUDES directory (defined by merging BMI_ROOT_DIR with the includes string) at line 118.

    However, BMI_ROOT_DIR is defined through the content-dir HTTP header found on line 62, thereby making BMI_ROOT_DIR subject to user control.

    Patch released within hours

    Wordfence reported the critical security flaw to BackupBliss, the development team behind the Backup Migration plugin, on December 6, with the developers releasing a patch hours later.

    However, despite the release of the patched Backup Migration 1.3.8 plugin version on the day of the report, almost 50,000 WordPress websites using a vulnerable version still have to be secured nearly one week later, as WordPress.org org download stats show.

    Admins are strongly advised to secure their websites against potential CVE-2023-6553 attacks, given that this is a critical vulnerability that unauthenticated malicious actors can exploit remotely.

    WordPress administrators are also being targeted by a phishing campaign attempting to trick them into installing malicious plugins using fake WordPress security advisories for a fictitious vulnerability tracked as CVE-2023-45124 as bait.

    Last week, WordPress also fixed a Property Oriented Programming (POP) chain vulnerability that could allow attackers to gain arbitrary PHP code execution under certain conditions (when combined with some plugins in multisite installations).

    Resource : https://www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/?&web_view=true

    11Dec, 2023
    Nvidia to expand ties with Vietnam, support AI development

    HANOI, Dec 11 (Reuters) – U.S. chipmaker Nvidia’s (NVDA.O) chief executive said on Monday the company will expand its partnership with Vietnam’s top tech firms and support the country in training talent for developing artificial intelligence and digital infrastructure.

    Nvidia, which has already invested $250 million in Vietnam, has so far partnered with leading tech companies to deploy AI in the cloud, automotive and healthcare industries, a document published by the White House in September showed when Washington upgraded diplomatic relations with Vietnam.

    “Vietnam is already our partner as we have millions of clients here,” Jensen Huang, Nvdia’s CEO said at an event in Hanoi in his first visit to the country.

    “Vietnam and Nvidia will deepen our relations, with Viettel, FPT, Vingroup, VNG being the partners Nvidia looks to expand partnership with,” Huang said, adding Nvidia would support Vietnam’s artificial training and infrastructure.

    Reuters reported last week Nvidia was set to discuss cooperation deals on semiconductors with Vietnamese tech companies and authorities in a meeting on Monday.

    Huang’s visit comes at a time when Vietnam is trying to expand into chip designing and possibly chip-making as trade tensions between the United States and China create opportunities for Vietnam in the industry.

    At Monday’s event, Vietnam’s investment minister Nguyen Chi Dzung said the country had been preparing mechanisms and incentives to attract investment projects in the semiconductor and artificial intelligence industries.

    Dzung also asked Nvidia to considering setting up a research and development facility in the country following Huang’s proposal to set up a base in Vietnam, after his meeting with the Vietnamese Prime Minister Pham Minh Chinh on Sunday.

    Resource : https://www.reuters.com/technology/nvidia-ceo-plans-expand-partnership-with-vietnam-support-vietnam-ai-development-2023-12-11/

    11Dec, 2023
    Nvidia CEO aims to set up a base in Vietnam

    HANOI, Dec 10 (Reuters) – Nvidia (NVDA.O) wishes to establish a base in Vietnam to develop the country’s semiconductor industry as it considers the Vietnamese market an important one, the Vietnamese government said, citing the U.S. chipmaker’s chief executive.

    In his first visit to the Southeast Asian country, Nvidia’s CEO, Jensen Huang, said the company viewed Vietnam as its home and affirmed its plans to set up a centre in the country.

    “The base will be for attracting talent from around the world to contribute to the development of Vietnam’s semiconductor ecosystem and digitalisation,” the Vietnamese government statement cited Huang after his meeting with Prime Minister Pham Minh Chinh.

    Nvidia, which has already invested $250 million in Vietnam, is set to discuss cooperation deals on semiconductors with Vietnamese tech companies and authorities in a meeting on Monday, Reuters reported on Friday.

    Vietnam, which is home to large chip assembling factories including Intel’s (INTC.O) biggest globally, is trying to expand into chip designing and possibly chip-making as trade tensions between the United States and China create opportunities for Vietnam in the industry.

    The chipmaker has already partnered with Vietnam’s leading tech companies to deploy AI in the cloud, automotive and healthcare industries, a document published by the White House in September showed when Washington upgraded diplomatic relations with Vietnam.

    Resource : https://www.reuters.com/technology/nvidia-ceo-aims-set-up-base-vietnam-2023-12-10/

    9Dec, 2023
    Gmail’s AI-powered spam detection is its biggest security upgrade in years

    The latest post on the Google Security blog details a new upgrade to Gmail’s spam filters that Google is calling “one of the largest defense upgrades in recent years.” The upgrade comes in the form of a new text classification system called RETVec (Resilient & Efficient Text Vectorizer). Google says this can help understand “adversarial text manipulations”—these are emails full of special characters, emojis, typos, and other junk characters that previously were legible by humans but not easily understandable by machines. Previously, spam emails full of special characters made it through Gmail’s defenses easily.

    If you want an example of what “adversarial text manipulation” looks like, the below message is something from my spam folder. My personal Gmail experience with these emails is that they used to be a major problem during the first half of the year, with emails like this regularly landing in my inbox. It does seem like this RETVec tech upgrade works, though, because emails like this haven’t been a problem at all for me in the last few months.

    Emails like this have been so difficult to classify because, while any spam filter could probably swat down an email that says, “Congratulations! A balance of $1,000 is available for your jackpot account,” that’s not what this email actually says. A big portion of the letters here are “homoglyphs“—by diving into the endless depths of the Unicode standard, you can find obscure characters that look like they’re part of the normal Latin alphabet but actually aren’t.

    For instance, the subject “𝐂𝐡𝐞𝐜𝐤_𝐘𝐨𝐮𝐫_𝐀𝐜𝐜𝐨𝐮𝐧𝐭” is weirdly bolded not because it has bolded styling but because it uses Unicode glyphs like the “Mathematical Bold Capital C.” It’s a math symbol that happens to look like the letter “C” to people, but the robot doing spam filtering accurately views it as a math symbol and doesn’t understand the intended English meaning. The closer you look at an email like this, the worse it gets: “C0NGRATULATIONS” has a zero replacing one of the “O” characters, the underlined letters in “Jᴀ̲ᴄ̲ᴋ̲pot” are so strange they don’t even come up in Unicode searches, and a lot of spaces are swapped out for periods or underscores. The result is that a spam filter looks at this hot mess of an email and basically gives up. (I don’t understand why illegible emails default to “inbox” instead of “spam,” but I’m not in charge.)

    Google says RETVec is here to save the day: “RETVec is trained to be resilient against character-level manipulations including insertion, deletion, typos, homoglyphs, LEET substitution, and more. The RETVec model is trained on top of a novel character encoder which can encode all UTF-8 characters and words efficiently. Thus, RETVec works out-of-the-box on over 100 languages without the need for a lookup table or fixed vocabulary size.”

    Google says the efficiency here is a big deal. Alternative approaches that used a “fixed vocabulary size” or “lookup table” for homoglyphs made them resource-intensive to run. Imagine a list of every possible spelling and misspelling of “congratulations” that swaps out one or more characters for numbers, math symbols, Cyrillic, Hebrew, or emojis, and you have a nearly endless list. Google says RETVec is only 200,000 “instead of millions of parameters,” so while Google’s spam-filtering cloud is probably big enough to run anything, this is small enough that it could even run on a local device. RETVec is open source, and Google hopes it will rid the world of homoglyph attacks, so even your local comment section could be running it someday.

    RETVec appears to work a lot like how humans read: It’s a machine-learning TensorFlow model that uses visual “similarity” to identify what words mean instead of their actual character content. Google’s similarity demo uses the same technology to identify pictures of cats, so turning that into the world’s fanciest optical character recognition system sounds pretty doable. Apparently, this approach has led to big improvements, with Google saying: “Replacing the Gmail spam classifier’s previous text vectorizer with RETVec allowed us to improve the spam detection rate over the baseline by 38% and reduce the false positive rate by 19.4%. Additionally, using RETVec reduced the TPU usage of the model by 83%, making the RETVec deployment one of the largest defense upgrades in recent years.”

    Resource : https://arstechnica.com/gadgets/2023/12/gmails-ai-powered-spam-detection-is-its-biggest-security-upgrade-in-years/

    9Dec, 2023
    Certificate and remote ID now required to fly drones in Europe

    Starting January 1st, 2024, new requirements in the European Union will come into effect, reshaping how small drones may be operated in the region. According to the European Union Aviation Safety Agency (EASA), with limited exceptions, even small drone pilots will require a certificate and registration, and drones must be equipped with a remote identification system.

    According to the EASA, drones starting from 900 grams in take-off mass (class identification labels from C1 to C6) are already equipped with a remote identification system, which transmits identification information such as the drone’s serial number, operator registration number, remote pilot position or, if not available, take-off point, and the drone’s location. These drones are mostly used for leisure activities and low-risk commercial activities.

    “After January 1st, 2024, only drones equipped with a remote identification system, updated with the UAS (drone) operator registration number, will be allowed to operate. States may identify geographical zones where remote identification is not mandatory,” the EASA publication reads.

    No training will be required for toy drones and those that are under 250 grams and have no camera or sensors on board. Those fall into the C0 category, for which a minimum remote pilot age of 16 is required unless the drone is a toy.

    For drones under 900 grams, the pilot must complete the online training and pass online theoretical exams. Larger drones require special remote pilot certificates, practical training, and passing an exam.

    Privately built drones and drones placed on the market before 2024 must also not overfly uninvolved people, maintain a horizontal distance of 150m from uninvolved people and urban areas, and maintain flight altitude below 120m above ground level.

    Remote pilots can obtain an EU drone license starting from around €50-€100 online, with the certificate valid for 5 years. The EASA is aware that some illegal websites are selling fake certificates of training: “Please trust only the providers of training and exams that are listed on the NAA website.”

    All remote pilots need to register themselves unless the drone weighs less than 250g and has no camera or other sensor able to detect personal data, or it’s a small drone that complies with a ‘toy’ directive.

    According to the EASA, open-category drone operators need to register themselves in the EU Member State where they have their residence for natural persons or where they have their principal place of business for legal persons. Third-country operators need to register in the first EASA Member State in which they perform an operation.

    Old drones must be retrofitted with remote ID

    All drones in the EU will be required to operate with an active and up-to-date Remote identification (RID) system. There are two ways to satisfy this condition: flying a C-class drone with RID built-in or retrofitting older drone models with an RID module attached to the drone body.

    “Remote identification (RID) technologies allow authorities and any member of the public to identify drones remotely using a smartphone app or dedicated receiver,” Dronetag, an RID manufacturer, which covers 70% of RID device supplies in the US, explained in a press release. “The main goal of RID adoption is to enhance the safety of unmanned aircraft systems operations.”

    RID transmitters can attached to the old drone body. According to Lukas Brchl, CEO of Dronetag, pilots should not ignore the upcoming change.

    “To avoid problems that framed the start of RID in the USA earlier this year, drone operators should get their RID module in advance if they want to use their drones in 2024 safely. The production capacities of all suppliers are limited, so my only advice is to act now. Dronetag team put immense effort into scaling production to the maximum, but we already accept orders with deliveries at the end of January 2024,” Brchl said.

    For small drones, he recommends using Direct RID modules, which transmit identification data via Bluetooth to the drone’s nearby surroundings.

    Resource : https://cybernews.com/security/certificate-and-remote-id-required-drone-pilots-europe/

    8Dec, 2023
    Future Intel, AMD and Arm CPUs Vulnerable to New ‘SLAM’ Attack: Researchers

    Academic researchers have disclosed the details of a new type of attack targeting modern CPUs, particularly future products from Intel, AMD and Arm. 

    The attack has been named SLAM, which stands for ‘Spectre based on Linear Address Masking’, and it was discovered by researchers at VUSec, the systems and network security group at the VU Amsterdam university in the Netherlands. 

    The researchers’ goal was to demonstrate that upcoming hardware-based security features such as Intel’s Linear Address Masking (LAM), AMD’s Upper Address Ignore (UAI) and Arm’s Top Byte Ignore (TBI), which should enable the implementation of fast security checks, can actually increase the surface for Spectre attacks. 

    Spectre is one of the original transient execution CPU vulnerabilities, which can expose potentially sensitive information from memory, such as encryption keys and passwords, to side-channel attacks. 

    According to the researchers, SLAM impacts some current AMD processors, as well as future Intel, AMD and Arm CPUs that will support LAM, UAI and TBI. 

    The experts demonstrated their findings by developing an end-to-end Spectre exploit targeting LAM on upcoming Intel processors. 

    The exploit focuses on the more recent Spectre BHI attack variant, which bypasses some of the hardware mitigations implemented in response to the original Spectre, and abuses various gadgets in the latest Linux kernel to leak the root password hash from kernel memory within minutes.

    Intel, AMD and Arm have been informed about the SLAM attack. Intel, one of the sponsors of the research, said it plans to provide software guidance prior to the release of CPUs that support LAM. In addition, Linux developers created patches to disable the security feature by default until guidance becomes available. 

    Arm has published a security advisory to inform customers about the attack, but noted that existing mitigations for Spectre v2 and Spectre BHI should prevent exploitation. 

    The researchers said AMD also claims existing Spectre v2 mitigations should prevent exploitation and the company has not released further guidance. 

    A technical paper detailing the SLAM attack has been made public, along with code and a video showing the exploit in action. 

    Resource : https://www.securityweek.com/future-intel-amd-and-arm-cpus-vulnerable-to-new-slam-attack-researchers/

    8Dec, 2023
    Five Cybersecurity Predictions for 2024

    The year 2023 saw heightened cybersecurity activity, with both security professionals and adversaries engaged in a constant cat-and-mouse game. The dynamic landscape of cyber threats and the ever-expanding digital attack surface have compelled organizations to refine and fortify their security architectures. Despite the collective hope for a reprieve from the onslaught of daily phishing, ransomware, and credential stuffing attacks, cybercriminals are poised to leverage successful tactics from this year to orchestrate more sophisticated campaigns in the coming year. To stay ahead, it is crucial to anticipate the key themes likely to dominate the cybersecurity space in 2024.

    The following predictions serve as strategic insights for IT and security professionals, guiding them in prioritizing efforts to navigate the ever-changing threat landscape:

    A Never-Ending Story: Compromised Credentials

    The perpetual use of usernames and passwords for access control and authentication has made compromised credentials a recurring vulnerability. Post-mortem analysis of data breaches consistently identifies compromised credentials as the primary point of attack. In fact, a study by the Identity Defined Security Alliance (IDSA) reveals that credential-based data breaches are both ubiquitous (94% of survey respondents experienced an identity-related attack) and highly preventable (99%). 

    Despite this, many organizations lack essential identity-related security controls. Those that have implemented proper access controls often focus on human users, neglecting the multitude of non-human identities arising from digital transformation initiatives (e.g., DevOps, cloud transformation, Internet of Things). As a result, compromised identities, both human and non-human, are expected to fuel cyberattacks in 2024. Organizations are urged to intensify efforts in implementing Zero Trust principles to reduce dependency on passwords.

    Ransomware Attacks Continue to Wreak Havoc

    The ransomware business thrives as cybercriminals exploit vulnerabilities in organizations, as witnessed in attacks on entities such as the Kansas Court System, Yamaha Motors, and Western Digital. In fact, the Ransomware-as-a-Service model has made launching attacks that much easier. Over the past year, ransomware attacks have evolved into multifaceted extortion schemes where data is exfiltrated and threatened to be publicly released if a ransom is not paid. The recent SEC complaint filed by the Alphv/BlackCat ransomware group against MeridianLink adds a new dimension to this tactic. With the new SEC disclosure ruling coming into effect on December 15, 2023, requiring companies to report “material” cybersecurity incidents within four days, this tactic is expected to become commonplace in ransomware attacks. Enterprises need to focus on ransomware preparedness, particularly in recovering endpoints and critical infrastructure such as Active Directory.

    Global Conflicts and Elections Lead to a Rise in Hacktivism

    The intersection of global conflicts and the 2024 Presidential elections in the US provides fertile ground for the emergence of hacktivism. Hacktivists, viewing themselves as champions of free expression, may counteract tightened control over information flow during times of conflict or elections by exposing information or launching attacks. Governments may covertly support hacktivist groups, blurring the lines between state-sponsored hacking and hacktivism. As elections are not only about ballots but also narratives, hacktivists can play a role in shaping public opinion through various cyber operations. The ease of using underlying tools may lead to material attacks involving deepfake voice and/or video content in 2024.

    White House Cybersecurity Strategy Triggers Revival of Vulnerability Management

    With cyber adversaries exploiting zero-day vulnerabilities, the White House’s National Cybersecurity Strategy, released in March 2023, shifts liability to organizations that fail to take reasonable precautions to secure their software. This strategy emphasizes the need for robust vulnerability management, involving the identification, assessment, prioritization, and mitigation of security vulnerabilities. The potential increase in liability for independent software vendors is expected to drive technological advancements in vulnerability management tools, leading to a revival of this otherwise dormant security category.

    The Emergence of Next-Gen Security Awareness Programs

    Security awareness training, a cornerstone of cybersecurity, is set for a transformation in 2024. The widespread adoption of generative artificial intelligence within the realm of cyber threats will render traditional training obsolete. Next-gen programs will embrace continuous breach and attack simulation (BAS) to validate user-focused controls’ efficacy and provide real-time guidance to prevent falling victim to contemporary social engineering attacks. Specialized tools will also focus on helping software developers learn secure coding practices to prevent vulnerabilities before they occur.

    Conclusion In summary, 2024 emphasizes the critical need to strike a balance between cybersecurity and cyber resilience. As IT and security professionals gear up for the year ahead, prioritizing the ability to see, protect, and manage the entire attack surface continually is paramount. Safeguarding mission-critical assets and developing the capacity to anticipate, withstand, recover from, and adapt to cyberattacks remain central to organizational cybersecurity strategies.

    Resource : https://www.securityweek.com/five-cybersecurity-predictions-for-2024/

    7Dec, 2023
    A New Protocol Vulnerability Will Haunt the Web for Years
    GOOGLE, AMAZON, MICROSOFT, and Cloudflare revealed this week that they battled massive, record-setting distributed denial of service attacks against their cloud infrastructure in August and September. DDoS attacks, in which attackers attempt to overwhelm a service with junk traffic to bring it down, are a classic internet menace, and hackers are always developing new strategies to make them bigger or more effective. The recent attacks were particularly noteworthy, though, because hackers generated them by exploiting a vulnerability in a foundational web protocol. This means that while patching efforts are well underway, fixes will need to essentially reach every web server globally before these attacks can be fully stamped out.

    Dubbed “HTTP/2 Rapid Reset,” the vulnerability can only be exploited for denial of service—it doesn’t allow attackers to remotely take over a server or exfiltrate data. But an attack doesn’t need to be fancy to cause major problems—availability is vital for access to any digital service, from critical infrastructure to crucial information.

    “DDoS attacks can have wide-ranging impacts to victim organizations, including loss of business and unavailability of mission-critical applications,” Google Cloud’s Emil Kiner and Tim April wrote this week. “Time to recover from DDoS attacks can stretch well beyond the end of an attack.”

    Another facet of the situation is where the vulnerability came from. Rapid Reset isn’t in a particular piece of software but in the specification for the HTTP/2 network protocol used for loading webpages. Developed by the Internet Engineering Task Force (IETF), HTTP/2 has been around for about eight years and is the faster, more efficient successor to the classic internet protocol HTTP. HTTP/2 works better on mobile and uses less bandwidth, so it has been extremely widely adopted. IETF is currently developing HTTP/3.

    “Because the attack abuses an underlying weakness in the HTTP/2 protocol, we believe any vendor that has implemented HTTP/2 will be subject to the attack,” Cloudflare’s Lucas Pardue and Julien Desgats wrote this week. Though it seems that there are a minority of implementations that are not impacted by Rapid Reset, Pardue and Desgats emphasize that the problem is broadly relevant to “every modern web server.”

    Unlike a Windows bug that gets patched by Microsoft or a Safari bug that gets patched by Apple, a flaw in a protocol can’t be fixed by one central entity because each website implements the standard in its own way. When major cloud services and DDoS-defense providers create fixes for their services, it goes a long way toward protecting everyone who uses their infrastructure. But organizations and individuals running their own web servers need to work out their own protections.

    Dan Lorenc, a longtime open source software researcher and CEO of the software supply chain security company ChainGuard, points out that the situation is an example of a time when the availability of open source and the prevalence of code reuse (versus always building everything from scratch) is an advantage, because many web servers have likely copied their HTTP/2 implementation from somewhere else rather than reinvent the wheel. If these projects are maintained, they will develop Rapid Reset fixes that can proliferate out to users.

    It will take years to reach full adoption of these patches, though, and there will still be some services that did their own HTTP/2 implementation from scratch and don’t have a patch coming from anywhere else.

    “It’s important to note that the big tech companies discovered this while it was being actively exploited,” Lorenc says. “It can be used to take a service down like operational tech or industrial control. That’s scary.”

    Though the string of recent DDoS attacks on Google, Cloudflare, Microsoft, and Amazon raised the alarm for being so large, the companies were ultimately able to repel the attacks, which didn’t cause lasting damage. But just by carrying out the assaults, hackers revealed the existence of the protocol vulnerability and how it could be exploited—a cause and effect known in the security community as “burning a zero day.” Even though the patching process will take time, and some web servers will remain vulnerable long term, the internet is safer now than if attackers hadn’t shown their cards by exploiting the flaw.

    “A bug like this in the standard is unusual, it’s a novel vulnerability and was a valuable finding for whoever first discovered it,” Lorenc says. “They could have saved it or even probably sold it for a lot of money. I’m always going to be curious about the mystery of why someone decided to burn this one.”

    Resource: https://www.wired.com/story/http-2-rapid-reset-flaw/

    7Dec, 2023
    Microsoft Will Eventually Start Charging You for Windows 10 Security Updates

    All good things must come to an end, and a decade after its first release, Windows 10 will finally be sent to a farm upstate. It had a good run, though Microsoft plans to keep dropping security updates after the OS’ demise on Oct. 14, 2025. Just be aware that the tech giant will force you to dip into your wallet to keep accessing security fixes and small bug hunts.

    That date is two years in the future, but Microsoft explained more of its plans in a Tuesday blog post. The current version, 22H2, will be the last of its kind for Windows 10, though it will still get monthly security updates all the way through the OS’ planned death date.

    After that, it will enter the “Extended Security Update” program that will allow both companies and individual users to purchase subscriptions to access monthly security updates. Businesses can purchase yearly ESU subscriptions, though Microsoft still has yet to detail how individual users can buy into the program. More importantly, we still don’t know how much it will cost individual users to avoid making the switch.

    It’s very much not recommended to keep using any software after it loses security updates, though, of course, you can keep accessing it at your own risk. The company last employed an ESU for Windows 7, which lasted from 2019 up to January of this year. That popular version of the OS received security updates all the way into 2020, even though it was released back in 2009.

    If a company pays for Windows 365 on a Windows 10 device that connects to a cloud PC that runs Windows 11, they’ll be able to access the ESU for free. Otherwise, Microsoft is really, really emphasizing that users should move on to Windows 11. It’s still free to switch to the newer operating system, but users wanting to avoid Microsoft’s big Copilot AI push or those increasingly annoying messages and ads to buy into Microsoft’s other software subscriptions may have had a good reason to delay.

    Windows 8 lasted about 10 years before it stopped receiving free security updates, but the company decided not to provide ESU service to the much less popular OS. Windows 10, on the other hand, is still much more widely used than the company’s latest version of Windows. Data from Statcounter shows Windows 10 still makes up close to 70% of the market share worldwide compared to just below 27% of Windows 11.

    Resource : https://gizmodo.com/microsfot-windows-10-charging-2025-1851074975

    6Dec, 2023
    New P2PInfect Botnet MIPS Variant Targeting Routers and IoT Devices

    Cybersecurity researchers have discovered a new variant of an emerging botnet called P2PInfect that’s capable of targeting routers and IoT devices.

    The latest version, per Cado Security Labs, is compiled for Microprocessor without Interlocked Pipelined Stages (MIPS) architecture, broadening its capabilities and reach.

    “It’s highly likely that by targeting MIPS, the P2PInfect developers intend to infect routers and IoT devices with the malware,” security researcher Matt Muir said in a report shared with The Hacker News.

    P2PInfect, a Rust-based malware, was first disclosed back in July 2023, targeting unpatched Redis instances by exploiting a critical Lua sandbox escape vulnerability (CVE-2022-0543, CVSS score: 10.0) for initial access.

    A subsequent analysis from the cloud security firm in September revealed a surge in P2PInfect activity, coinciding with the release of iterative variants of the malware.

    The new artifacts, besides attempting to conduct SSH brute-force attacks on devices embedded with 32-bit MIPS processors, pack in updated evasion and anti-analysis techniques to fly under the radar.

    The brute-force attempts against SSH servers identified during the scanning phase are carried out using common username and password pairs present within the ELF binary itself.

    It’s suspected that both SSH and Redis servers are propagation vectors for the MIPS variant owing to the fact that it’s possible to run a Redis server on MIPS using an OpenWrt package known as redis-server.

    One of the notable evasion methods used is a check to determine if it’s being analyzed and, if so, terminate itself, as well as an attempt to disable Linux core dumps, which are files automatically generated by the kernel after a process crashes unexpectedly.

    The MIPS variant also includes an embedded 64-bit Windows DLL module for Redis that allows for the execution of shell commands on a compromised system.

    “Not only is this an interesting development in that it demonstrates a widening of scope for the developers behind P2PInfect (more supported processor architectures equals more nodes in the botnet itself), but the MIPS32 sample includes some notable defense evasion techniques,” Cado said.

    “This, combined with the malware’s utilization of Rust (aiding cross-platform development) and rapid growth of the botnet itself, reinforces previous suggestions that this campaign is being conducted by a sophisticated threat actor.”

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resource : https://thehackernews.com/2023/12/new-p2pinfect-botnet-mips-variant.html