Upload File

network intelligence security advisory...2020/11/28  · network intelligence security advisory the...

  • Home
  • Documents
  • NETWORK INTELLIGENCE SECURITY ADVISORY...2020/11/28  · NETWORK INTELLIGENCE SECURITY ADVISORY The major security news items of the month - major threats and security patch advisory
6
NETWORK INTELLIGENCE SECURITY ADVISORY The major security news items of the month - major threats and security patch advisory. The advisory also includes IOCs and remedia�on steps. Digest November 2020, Edi�on 2.0 IN THIS EDITION: Security Advisory Listing Severity To know more about our services reach us at info@niiconsul�ng.com or visit www.niiconsul�ng.com Directory Traversal and Remote Code Execution Vulnerability (CVE- 2020-8271) in Citrix SD-WAN Center which was widely exploited in targeted hacking campaigns Security Patch Advisory Critical A Threat Actor Group was found targeting Organisations IT systems using new ransomware called Egregor ALSO INSIDE Critical Critical Critical Critical Remote code execution Vulnerability (CVE-2020-13671) was found in Critical Drupal platform – Government and Business entities were at high risk Remote Code Execution vulnerabilities (CVE-2020-28949, and CVE-2020-28948) within PEAR Archive_Tar library of Drupal which were widely exploited in Hacking Campaign and Malware distribution

Upload: others

Post on 01-Feb-2021

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

  • NETWORK INTELLIGENCE SECURITY ADVISORYThe major security news items of the month - major threats and security patch advisory. The advisory also includes IOCs and remedia�on steps.

    DigestNovember 2020, Edi�on 2.0

    IN THIS EDITION:

    Security Advisory Listing Severity

    To know more about our services reach us at info@niiconsul�ng.com or visit www.niiconsul�ng.com

    Directory Traversal and Remote Code Execution Vulnerability (CVE- 2020-8271) in Citrix SD-WAN Center which was widely exploited in targeted hacking campaigns

    Security Patch Advisory

    Critical

    A Threat Actor Group was found targeting Organisations IT systems using new ransomware called Egregor

    ALSO INSIDE

    Critical

    Critical

    CriticalCritical Remote code execution Vulnerability (CVE-2020-13671) was found in Critical Drupal platform – Government and Business entities were at high risk

    Remote Code Execution vulnerabilities (CVE-2020-28949, and CVE-2020-28948) within PEAR Archive_Tar library of Drupal which were widely exploited in Hacking Campaign and Malware distribution

    mailto:[email protected]://www.niiconsulting.com

  • Remote Code Execution vulnerabilities (CVE-2020-28949, and CVE-2020-28948) within PEAR Archive_Tar library of Drupal which were widely exploited in Hacking Campaign and Malware distribution

    SECURITY ADVISORY

    Date: November 28, 2020

    Severity: Critical

    READ

    INTRODUCTION

    Remote Code Execution vulnerabilities (CVE-2020-28949, andCVE-2020-28948) within PEAR Archive_Tar library of Drupal, iswidely exploited in Hacking Campaign and Malware distribution. These vulnerabilities is due to the PEAR Archive_Tar libraryimproperly handle the file upload and processing functions whenaffected versions of Drupal is configured to allow uploading file withextensions such as .tar, .tar.gz, .bz2, .tlz, and triggers remote codeexecution while process the file. In attack scenario, the remote attacker can take advantage of thesevulnerabilities by uploading specifically crafted malicious file bearingextensions such as .tar, .tar.gz, .bz2, .tlz, and the moment Drupalsite running affected version attempts to process the file, then it willtrigger the code execution flaw to execute the malicious code on theDrupal site hosting server. As a result, it will allow remote attackersto gain unauthorized initial access to the Drupal site, and uploadtheir malware for further distribution. Such vulnerabilities are oftentaken advantaged for malware distribution including SodinokibiRansomware attack. These vulnerabilities pose a severe risk of unauthorized access,data breach, data loss, interruption of business operation, impactreputation of an organization, and financial loss.

    • Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

    NoREMEDIATION

    1. Update Drupal 9.0.x, to version 9.0.9 2. Update Drupal 8.9.x, to version8.9.10 3. Update Drupal 8.8.x or earlier, toversion 8.8.12 4. Update Drupal 7, to version 7.75 5. Upgrade Drupal 8 prior to 8.8.x, toeither of these versions 8.8.12,8.9.10 or 9.0.9.

    AFFECTED PRODUCTS • Drupal 9.0, versions prior to Drupal 9.0.9• Drupal 8.9, versions prior to Drupal 8.9.10• Drupal 8.8 or earlier, versions prior to Drupal 8.8.12• Drupal 7, versions prior to Drupal 7.75 • Important:- Versions of Drupal 8 prior to 8.8.x are end-of-life and do notreceive security coverage.

    IMPACT

    These vulnerabilities pose a severe riskof unauthorized access, data breach,data loss, interruption of businessoperation, impact reputation of anorganization, and financial loss

    https://www.drupal.org/sa-core-2020-013https://www.drupal.org/project/drupal/releases/9.0.9https://www.drupal.org/project/drupal/releases/8.9.10https://www.drupal.org/project/drupal/releases/8.8.12https://www.drupal.org/project/drupal/releases/7.75https://www.drupal.org/project/drupal/releases/8.9.10https://www.drupal.org/project/drupal/releases/8.9.10https://www.drupal.org/project/drupal/releases/9.0.9

  • Critical Remote code execution Vulnerability (CVE-2020-13671) was found in Critical Drupal platform – Government and Business entities were at high risk

    SECURITY ADVISORY

    Date: November 19, 2020

    Severity: Critical

    IMPACT

    Successful exploitation of vulnerability(CVE-2020-13671) in Drupal platform,poses a risk of unauthorized access,data breach, interruption of services,privilege escalation and impactreputation of an organization

    READ

    INTRODUCTION

    A vulnerability has been discovered in the Drupal core module,which could allow for remote code execution. Drupal is an opensource content management system (CMS) written in PHP.Successful exploitation of this vulnerability could allow for remotecode execution. Depending on the privileges associated with theuser, an attacker could then install programs; view, change, ordelete data; or create new accounts with full user rights. Userswhose accounts are configured to have fewer user rights on thesystem could be less impacted than those who operate withadministrative user rights. The remote code execution vulnerability exists due to a lack ofproper data sanitization of certain filenames on uploaded files. Thiscan lead to files being interpreted as the incorrect extension, servedas the wrong MIME type, or executed as PHP for certain hostingconfigurations.

    • Drupal core - Critical - Remote code execution - SA-CORE-2020-012• Remote Code Execution Vulnerability Patched in Drupal

    No

    AFFECTED PRODUCTS • Drupal Core versions prior to 9.0.8, 8.9.9, 8.8.11, and 7.74

    REMEDIATION

    1. Kindly update Drupal 9.0 to Drupal 9.0.82. Kindly update Drupal 8.9 to Drupal 8.9.93. Kindly update Drupal 8.8 or earlier to Drupal 8.8.114. Kindly update Drupal 7 to Drupal 7.74 5. Ensure no unauthorized system changes have occurred before applying patches. 6. Run all software as a non-privilegeduser to diminish effects of a successfulattack. 7. Apply the Principle of Least Privilege to all systems and services.

    TEMPORARY MITIGATION

    Disable all web services modules orconfigure your web server(s) to not allow GET/PUT/PATCH/POST requests to web services resources.

    https://www.drupal.org/sa-core-2020-012https://www.securityweek.com/remote-code-execution-vulnerability-patched-drupal

  • Directory Traversal and Remote Code Execution Vulnerability (CVE- 2020-8271) in Citrix SD-WAN Center which was widely exploited in targeted hacking campaigns

    SECURITY ADVISORY

    Date: November 18, 2020

    Severity: Critical

    IMPACT

    Successful exploitation of thesevulnerabilities (CVE-2020-8271, CVE-2020-8272, CVE-2020-8273) in CitrixSD-WAN Center, poses a risks ofunauthorized access, data breach,interruption in business services, cause financial loss, and impact reputation of an organization.

    READ

    INTRODUCTION

    Directory Traversal and Remote Code Execution Vulnerability (CVE-2020-8271) in Citrix SD-WAN Center, is widely exploited in targetedhacking campaigns. The unauthenticated remote attackers are taking advantage of thisvulnerability (CVE-2020-8271) to gain unauthorized access onto therestricted directory path and perform unauthorized API operationson files stored on the affected Citrix SD-WAN Server, by sending aspecifically crafted packets. The unauthenticated remote attackers can also take advantage ofAuthentication Bypass Vulnerability (CVE-2020-8272) to gainunauthorized access to any Citrix SD-WAN API interface, andfurther exploit Privilege Escalation Vulnerability (CVE-2020-8273) toexecute arbitrary commands as Root, by sending a specificallycrafted packets. Successful exploitation of these vulnerabilities (CVE-2020-8271,CVE-2020-8272, CVE-2020-8273) in Citrix SD-WAN Center, posesa risks of unauthorized access, data breach, interruption in businessservices, cause financial loss, and impact reputation of anorganization. These risks can be temporarily mitigated either by limiting exposureof or restricting access to Citrix SD-WAN Center (which is an internalmanagement platform for Citrix SD-WAN) from internet and DMZfacing sides. However, it is strongly recommended to apply availablesecurity patches to completely mitigate the risks.

    • Citrix SDWAN Center Security Update• SD-PWN Part 2 — Citrix SD-WAN Center — Another Network Takeover

    No

    AFFECTED PRODUCTS • Citrix SD-WAN 11.2.x before 11.2.2• Citrix SD-WAN 11.1.x before 11.1.2b• Citrix SD-WAN 10.2.x before 10.2.8

    REMEDIATION

    1. Kindly update Citrix SD-WAN 11.2.x,to version 11.2.2 and later 2. Kindly update Citrix SD-WAN 11.1.x,to version 11.1.2b and later 3. Kindly update Citrix SD-WAN 10.2.x,to version 10.2.8 and later.

    https://support.citrix.com/article/CTX285061https://medium.com/realmodelabs/sd-pwn-part-2-citrix-sd-wan-center-another-network-takeover-a9c950a1a27chttps://www.citrix.com/en-gb/downloads/citrix-sd-wan/https://www.citrix.com/en-gb/downloads/citrix-sd-wan/https://www.citrix.com/en-gb/downloads/citrix-sd-wan/

  • A Threat Actor Group was found targeting Organisations IT systems using new ransomware called Egregor

    SECURITY ADVISORY

    Date: November 16, 2020

    Severity: Critical

    IP SUBNETS 49.12.104.24191.199.212.52

    READ

    REMEDIATION

    1. Block the threat indicators at their respective controls.2. Do not download untrusted email attachments coming from unknown email addresses.3. Keep all systems and software updated to latest patched versions

    • Rewterz Threat Alert – Egregor Ransomware – Continued Malicious Activities• Egregor Ransomware Threatens ‘Mass-Media’ Release of Corporate Data• CERT-In is warning companies in India to be careful about a new ransomware• Egregor ransomware gang leaked data alleged stolen from Ubisoft, Crytek

    Hashes

    c94fdfedd40e0b194165294f484977947df9da2000cb8fe02243961384b249ff

    D E T E C T E D B Y A N T I V I R U S

    Symantec TrendMicro McAfee Quick Heal Microso�

    HASH (SHA-256)

    7d587a5f6f36a74dc�cbaecb2b0547fdf1ecdb034341f4cc7ae489f5b57a11d3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71 Yes

    Yes

    Yes yes

    yes

    Yes

    No

    No

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    14296b21c6e2ba9d56759e2da4b09f58148852ddeefa8�76a838a30871679a7

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    https://www.rewterz.com/rewterz-news/rewterz-threat-alert-egregor-ransomware-continued-malicious-activitieshttps://threatpost.com/egregor-ransomware-mass-media-corporate-data/159816/https://ciso.economictimes.indiatimes.com/news/cert-in-is-warning-companies-in-india-to-be-careful-about-a-new-ransomware/79110630https://securityaffairs.co/wordpress/109530/malware/egregor-ransomware-gang-ubisoft-crytek.html

  • Belden, the manufacturer of networking and cable products had suffered data breach incident caused by threat actors

    November 26, 2020

    NEWSLETTER

    DATA BREACH HIGHLIGHTS

    November 2020, Edi�on 2.0

    BigBasket, an Indian-based online grocery store had suffered data breach incident that exposed 20 million user records to cyber criminals on underground forum

    • 20 million Bigbasket user records available on the dark web• Bigbasket faces potential data breach

    November 29, 2020

    The North Face, an American outdoor recrea�on product company had suffereda creden�al stuffing a�ack followed by data breach incident caused by a�ackersNovember 15, 2020

    • The North Face website suffered a creden�al stuffing a�ack

    • Belden discloses data breach as a result of cyber a�ack

    https://securityaffairs.co/wordpress/110543/data-breach/bigbasket-details-dark-web.htmlhttps://securityaffairs.co/wordpress/110543/data-breach/bigbasket-details-dark-web.htmlhttps://www.firstpost.com/business/bigbasket-faces-potential-data-breach-details-of-2-crore-users-likely-to-have-been-leaked-put-for-sale-on-dark-web-8994691.htmlhttps://securityaffairs.co/wordpress/111468/data-breach/belden-discloses-data-breach.htmlhttps://securityaffairs.co/wordpress/111468/data-breach/belden-discloses-data-breach.htmlhttps://securityaffairs.co/wordpress/110952/data-breach/the-north-face-credential-stuffing.htmlhttps://securityaffairs.co/wordpress/110952/data-breach/the-north-face-credential-stuffing.html

2015 security intelligence

International Security Advisory Board

Security Intelligence - · PDF file · 2016-02-20What is Security Intelligence –and why is it important? ... Security intelligence reduces risk, facilitates compliance, ... Firewall

SECURITY INTELLIGENCE ADVISORY - Sattrix

Information Security Advisory Council

SECURITY INTELLIGENCE SYSTEMS(A Pa1538.g.akamai.net/7/1538/13355/v001/homeoffice.download.akamai... · SECURITY INTELLIGENCE SYSTEMS(A) Principles: ... SECURITY INTELLIGENCE SYSTEM

Security Intelligence Blacklisting - Cisco · Security Intelligence Blacklisting ThefollowingtopicsprovideanoverviewofSecurityIntelligence,includinguseforblacklistingand whitelistingtrafficandbasicconfiguration

Artificial Intelligence Investment Banking + M&A Advisory · PDF fileArtificial Intelligence Investment Banking + M&A Advisory Artificial Intelligence M&A and VC Funding Update Q2

NETWORK INTELLIGENCE SECURITY ADVISORY...NETWORK INTELLIGENCE SECURITY ADVISORY The major security news items of the month - major threats and security patch advisory. The advisory

Corporate Intelligence: Bridging the security and intelligence community

DSCI THREAT INTELLIGENCE AND RESEARCH INITIATIVE · 4 TI&R © Data Security Council of India 2020 Threat Advisory Signature/ IoCs 4e8d4338cd3b20cb027a8daf108c654c10843e549c3f3da6646ac2bb8ffbe24d

What is Intelligence Driven Security? - Dell EMC · Adopt Intelligence Driven Security to build trust in a digital world What is Intelligence Driven Security? Intelligence Driven

Intelligence Driven Security

NETWORK INTELLIGENCE SECURITY ADVISORY · NETWORK INTELLIGENCE SECURITY ADVISORY Everything you need to know about the latest threat components cropping up globally and also the remedia

ADVISORY AND INTELLIGENCE SERVICES - EOS Risk · ADVISORY AND INTELLIGENCE SERVICES Governing Your Risk n Securing People Actionable Intelligence and Security Risk Assessments In

IBM Security Intelligence

INTERNATIONAL SECURITY CONGRESS (Intelligence and Security

Head of Intelligence & Analysis, Director, Risk Advisory...Eric Kaler Senior Director, Security, Hawaiian Airlines – Moderator • John Cauthen Director of Aviation Security, MedAire

Security Intelligence: Driving Security From Analytics to Action...Security Intelligence: By Design Functionally, security intelligence is a method by which data and insights are collected,

MitKat Advisory Servicesprotective intelligence, geo-political and security risk advisory services. We work collaboratively with clients to promote business and protect key assets

Security intelligence for service providers€¦ · How QRadar Security Intelligence Platform can help. QRadar Security Intelligence Platform delivers security and compliance benefits

QRadar Security Intelligence Platform (NDcPP10) Security

Business Consulting Financial Advisory · business consulting | financial advisory | strategic intelligence. soc 3 report software as a service report on security principle placed

Security Intelligence

SYMANTEC SECURITY INTELLIGENCEsecurity-intelligence.symantec.com/ebook/Security-Intelligence... · Security intelligence is the engine that powers cyber resilience. With better intelligence,

Realizing Efficient Enterprise Security Intelligence by … · Realizing Efficient Enterprise Security Intelligence by Using IBM Security Intelligence Solutions Nilesh Patel Arun

IBM Security: Intelligence, Integration, Expertisepublic.dhe.ibm.com/.../IBM_Security_Intelligence_Integration_Expertis… · IBM Security: Intelligence, Integration, Expertise

AAF SCIENTIFIC ADVISORY GROUP Technical Intelligence Supplement_VKarman_V3

Security advisory format

NETWORK INTELLIGENCE SECURITY ADVISORY › Security_Advisories › Security_Adviso… · South-East Asia and other regions on global scale An exploitable Remote Code Execution vulnerability

NETWORK INTELLIGENCE SECURITY ADVISORY

Security Intelligence Blacklisting · Security Intelligence Blacklisting ThefollowingtopicsprovideanoverviewofSecurityIntelligence,includinguseforblacklistingand whitelistingtrafficandbasicconfiguration

SECURITY INTELLIGENCE ADVISORY

Business Intelligence Security

IT Executive Guide to Security Intelligence Transitioning From SIEM to Total Security Intelligence