76
1
How to Investigate an OAuth Grant for Suspicious Activity or Overly Permissive Scopes
(thehackernews.com)
The War Room
1 readers
1 users here now
Community for various OSINT news and subject matter for open discussion or dissemination elsewhere
founded 1 year ago
MODERATORS
77
1
US Gov Warns of Foreign Intelligence Cyberattacks Against US Space Industry
(www.securityweek.com)
78
79
80
81
82
1
Brazilian Hacker Claims Bolsonaro Asked Him to Hack Into the Voting System Ahead of 2022 Vote
(www.securityweek.com)
83
1
This Malware Turned Thousands of Hacked Windows and macOS PCs into Proxy Servers
(thehackernews.com)
84
1
Flaws in Juniper Switches and Firewalls Can Be Chained for Remote Code Execution
(www.securityweek.com)
85
86
87
88
89
90
91
92
93
1
PoC exploit for 0-day Windows Error Reporting Service bug (CVE-2023-36874) releases
(securityonline.info)
94
95
96
Hands on with Windows 11's 'never combine' taskbar feature
Windows 11, already a monumental shift in design from its predecessor, continues to evolve.
In its upcoming 23H2 release slated for fall, one of the standout features that has caught the eye of many is the 'never combine mode' for the taskbar.
Previously, Windows 10 users will recall the ability to keep icons on the taskbar separate, which can be especially helpful when juggling multiple windows from the same app. The 'never combine' option ensures each window has its representation on the taskbar without grouping them.
Microsoft removed the 'never combine mode' for the taskbar' with Windows 11, but it's finally coming back with version 23H2.
Additionally, enabling this mode has been streamlined for user convenience. The steps are straightforward:
- Access Taskbar Settings: Simply right-click on the taskbar. A menu will pop up.
- Navigate to Taskbar Behaviors: Select “Taskbar settings” from the pop-up menu.
- Adjust Preferences: Under the section labeled “Taskbar behaviors”, find the option that reads “Combine taskbar buttons and hide labels”. From the drop-down menu adjacent to it, select 'never'.
But what if you're a power user with multiple monitors? Microsoft has improved the behaviour and introduced a separate setting dedicated to those who operate in multi-monitor environments. It allows them to choose if they want the 'never combine' feature applied consistently across all taskbars on different screens.
This feature can be particularly useful for those who multitask across various apps ns and prefer an ungrouped view on their taskbars. It offers more direct access to individual windows and can help in enhancing productivity by reducing the number of clicks and the time spent in searching for the desired window among grouped icons.
In conclusion, it is a reflection of listening to feedback and ensuring that users have the tools to customize their experiences.
97
98
Cuba ransomware uses Veeam exploit against critical U.S. organizations
Image: Midjourney
The Cuba ransomware gang was observed in attacks targeting critical infrastructure organizations in the United States and IT firms in Latin America, using a combination of old and new tools.
BlackBerry's Threat Research and Intelligence team, which spotted the latest campaign in early June 2023, reports that Cuba now leverages CVE-2023-27532 to steal credentials from configuration files.
The particular flaw impacts Veeam Backup & Replication (VBR) products, and an exploit for it has been available since March 2023.
Previously, WithSecure reported that FIN7, a group with multiple confirmed affiliations with various ransomware operations, was actively exploiting CVE-2023-27532.
Cuba attack details
BlackBerry reports that Cuba's initial access vector appears to be compromised admin credentials via RDP, not involving brute forcing.
Next, Cuba's signature custom downloader 'BugHatch' establishes communication with the C2 server and downloads DLL files or executes commands.
An initial foothold on the target environment is achieved through a Metasploit DNS stager that decrypts and runs shellcode directly in memory.
DNS stager query (BlackBerry)
Cuba utilizes the now-widespread BYOVD (Bring Your Own Vulnerable Driver) technique to turn off endpoint protection tools. Also, it uses the 'BurntCigar' tool to terminate kernel processes associated with security products.
Apart from the Veeam flaw that's relatively recent, Cuba also exploits CVE-2020-1472 ("Zerologon"), a vulnerability in Microsoft's NetLogon protocol, which gives them privilege escalation against AD domain controllers.
Zerologon exploit helper (BlackBerry)
In the post-exploitation phase, Cuba was observed using Cobalt Strike beacons and various "lolbins."
Complete attack chain (BlackBerry)
Cuba still very active
BlackBerry underlines the clear financial motivation of the Cuba ransomware gang and mentions that the threat group is likely Russian, something that has been hypothesized by other cyber-intelligence reports in the past.
This assumption is based on the exclusion of computers that use a Russian keyboard layout from infections, Russian 404 pages on parts of its infrastructure, linguistic clues, and the group's Western-focused targeting.
In conclusion, Cuba ransomware remains an active threat approximately four years into its existence, which isn't common in ransomware.
The inclusion of CVE-2023-27532 in Cuba's targeting scope makes the prompt installation of Veeam security updates extremely important and once again highlights the risk of delaying updates when publicly available PoC (proof-of-concept) exploits are available.
99
Google Chrome to warn when installed extensions are malware
Google is testing a new feature in the Chrome browser that will warn users when an installed extension has been removed from the Chrome Web Store, usually indicative of it being malware.
An unending supply of unwanted browser extensions is published on the Chrome Web Store and promoted through popup and redirect ads.
These extensions are made by scam companies and threat actors who use them to inject advertisements, track your search history, redirect you to affiliate pages, or in more severe cases, steal your Gmail emails and Facebook accounts.
The problem is that these extensions are churned out quickly, with the developers releasing new ones just as Google removes old ones from the Chrome Web Store.
Unfortunately, if you installed one of these extensions, they will still be installed in your browser, even after Google detects them as malware and removes them from the store.
Due to this, Google is now bringing its Safety Check feature to browser extensions, warning Chrome users when an extension has been detected as malware or removed from the store and that they should be uninstalled from the browser.
This feature will go live in Chrome 117, but you can now test it in Chrome 116 by enabling the browser's experimental 'Extensions Module in Safety Check' feature.
To enable the feature, simply copy the Chrome URL, 'chrome://flags/#safety-check-extensions', into the address bar and press enter. You will be brought to the Chrome Flags page with the 'Extensions Module in Safety Check' feature highlighted.
Now set it to enabled and restart the browser when prompted to enable the feature.
Google Chrome Safety Check for extensions
Once enabled, a new option will appear under the 'Privacy and security' settings page that prompts you to review any extensions removed from the Chrome Web Store, as shown below.
Safety check for Chrome extensions
Source: Google
Clicking this link will bring you to your extension page, listing the removed extensions and why they were removed and prompting you to uninstall them.
Potentially malicious extensions removed from Chrome Web Store
Source: Google
Google says that extensions can be removed from the Chrome Web Store because they were unpublished by the developer, violated policies, or were detected as malware.
For extensions detected as malware, it is strongly advised that you remove them immediately to not only protect your data but also to prevent your computer from facing future attacks.
For those that are removed for other reasons, it is advised that you remove them as well, as they are no longer supported or break other policies that are not strictly malware but are not necessarily helpful.
Google has a dedicated Chrome Web Store policies page detailing what content or behavior could lead to an extension being removed from the store.
100