Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Alert 28 November 2023 – Legal Sector Technology Provider CTS Hit by Cyber Attack, Up To 200 UK Law Firms Impacted
Black Arrow Cyber Alert 28 November 2023 – Legal Sector Technology Provider CTS Hit by Cyber Attack, Up To 200 UK Law Firms Impacted
Executive summary
A cyber attack on CTS, who are a leading IT provider for law firms, conveyancers, and others within the UK’s legal sector, has resulted in a significant outage across 80-200 UK law firms. This comes as major law firm Allen and Overy were removed from a ransomware website one day before the deadline.
What’s the risk to me or my business?
If you use or have previously used CTS as a provider, the confidentiality, integrity and availability of your data may be compromised. Some firms have already felt the impact, being left unable to work due to outages. At current, there is no indication as to when availability will resume.
What can I do?
Black Arrow recommends firms check whether they are using CTS or have used CTS as a provider. In addition, firms should also be extra vigilant when communicating with other UK law firms as their may be an increased risk of phishing.
Black Arrow offer a free, no-obligation, introductory consultation to help you gain an unbiased perspective on your current security approach could withstand an attacker. We help our clients to know the questions to ask of their external or internal IT provider, and how to leverage other security controls from existing resources.
Further information and guidance can be found here:
https://www.computing.co.uk/news/4150671/law-firm-service-provider-cts-hit-major-cyberattack
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatalert #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 24 November 2023 – Windows SmartScreen Vulnerability Under Active Exploitation
Black Arrow Cyber Advisory 24 November 2023 – Windows SmartScreen Vulnerability Under Active Exploitation
Executive summary
Financially motivated threat actors are currently exploiting a critical vulnerability in unpatched versions of Windows SmartScreen. The vulnerability which is under exploitation was patched in Microsoft’s November patch Tuesday. Since its patch, a proof of concept exploiting the vulnerability in Windows SmartScreen has become publicly available.
What’s the risk to me or my business?
Windows SmartScreen is a security feature that prevents potentially harmful malware from running. It checks applications or files to ensure that they are safe; if they are not deemed to be safe, it will give the users the option to cancel running them. The now publicly available exploit allows an attacker to cause a victim to automatically run malware, bypassing SmartScreen checks and therefore impacting the confidentiality, integrity, and availability of data. For an attacker to be able to exploit, all they would need is a user to click on a malicious URL.
What can I do?
Black Arrow recommends applying the patches made available by Microsoft immediately, which can be found in our blog post detailed below. Organisations running unpatched versions are leaving themselves at risk of exploitation.
Technical Summary
CVE-2023-36025- A security bypass vulnerability in Windows SmartScreen
Further information can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 15 November 2023 – Microsoft Patch Tuesday fixes five zero days, three actively exploited; Adobe, FortiGuard, VMware and WordPress Updates Summary
Black Arrow Cyber Advisory 15 November 2023 – Microsoft Patch Tuesday fixes five zero days, three actively exploited; Adobe, Fortinet, VMware and WordPress Updates Summary
Executive summary
Microsoft’s November Patch Tuesday provides updates to address 58 security issues across its product range, including three actively exploited zero-day vulnerabilities. The exploited zero-day vulnerabilities include two privilege escalation vulnerabilities and a security bypass. These have been added the US Cybersecurity and Infrastructure Security Agency’s (CISA) “Known Exploited Vulnerabilities Catalog”. Also among the updates provided by Microsoft were 3 critical vulnerabilities.
In addition to the Microsoft updates this week Adobe, FortiGuard, VMware and WordPress also provided updates for vulnerabilities in their products. An addressed vulnerability in Citrix known as Citrix Bleed continues to remain a threat, with ransomware gang LockBit actively exploiting publicly known exploits for unpatched versions.
What’s the risk to me or my business?
The actively exploited vulnerability could allow an attacker with access, to bypass security, gain SYSTEM privileges and compromise the confidentiality, integrity and availability of data stored by an organisation.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating.
Technical Summary
CVE-2023-36036: An actively exploited elevation of privilege vulnerability in Windows Cloud Files Mini Filter.
CVE-2023-36033: An actively exploited elevation of privilege vulnerability in Windows DWM Core Library that could allow an attacker to gain the highest privileges.
CVE-2023-36025: An actively exploited vulnerability in Windows SmartScreen which allows a malicious internet shortcut to bypass security.
CVE-2023-36413: A Microsoft Office security feature bypass.
CVE-2023-36038: A denial of service vulnerability in ASP.NET Core.
Adobe
This month, Adobe released fixes for 25 vulnerabilities, of which 13 were rated critical, across Adobe Acrobat and Reader (17), ColdFusion (6), InCopy (1), and Dimension(1). At current, Adobe is not aware of any of these vulnerabilities being actively exploited. The vulnerabilities include remote code execution, memory leak, privilege escalation and security bypass.
Citrix
The LockBit ransomware group are using the publicly available exploits for the Citrix bleed Vulnerability. There are currently thousands of publicly available endpoints which are running and still vulnerable.
FortiGuard
This month, Fortiguard released three advisories for vulnerabilities, including one critical vulnerability, impacting FortiOS, FortiProxy-DOS and FortiProxyVM.
VMware
VMware has patched one critical authentication bypass vulnerability, tracked as CVE-2023-34060 which impacts Cloud Director Appliances. There are no available workarounds.
WordPress
A WordPress plugin, WP Fastest Cache, is vulnerable to an SQL injection vulnerability tracked as CVE-2023-6063, which could allow unauthenticated attackers to read the contents of the site’s database. At current, more than 600,000 websites run a vulnerable version of WP Fastest Cache. A software patch has been made available by the developer.
Further details on other specific updates within this month’s Microsoft Patch Tuesday can be found here: https://www.ghacks.net/2023/04/11/microsoft-windows-security-updates-april-2023-what-you-need-to-know-before-installation/
Adobe
Further details of the vulnerabilities addressed in Adobe Acrobat and Reader can be found here: https://helpx.adobe.com/security/products/acrobat/apsb23-54.html
Further details of the vulnerabilities addressed in Adobe ColdFusion can be found here:
https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
Further details of the vulnerabilities addressed in Adobe Dimension can be found here: https://helpx.adobe.com/security/products/dimension/apsb23-62.html
Further details of the vulnerabilities addressed in Adobe InCopy can be found here: https://helpx.adobe.com/security/products/incopy/apsb23-60.html
Citrix
Further details about the Citrix Bleed vulnerability can be found here:
https://www.blackarrowcyber.com/blog/advisory-26-october-2023-citrix-bleed-vulnerability
FortiGuard
Further details on the FortiGuard advisories can be found here:
https://www.fortiguard.com/psirt
VMware
Further information of the vulnerability address by VMware can be found here: https://www.vmware.com/security/advisories/VMSA-2023-0026.html
WordPress
Further information on the WordPress vulnerability can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 09 November 2023 – High Severity Veeam ONE Vulnerabilities
Black Arrow Cyber Advisory 09 November 2023 – High Severity Veeam ONE Vulnerabilities
Executive summary
Veeam has released patches to fix four vulnerabilities including two critical rated vulnerabilities. If exploited the critical vulnerabilities could allow an unauthenticated attacker to steal NTLM hashes to accounts and perform remote code execution on their server hosting the product database.
What’s the risk to me or my business?
There is a risk that organisations with vulnerable products are leaving themselves at risk of allowing an attacker to perform remote code execution and stealing NTLM Hashes. This allows an attacker to log in as the stolen users credentials and perform remote code execution impacting the confidentiality, integrity and availability of data.
The following products affected:
· Veeam ONE 11 – this is fixed in version (11.0.0.1379)
· Veeam ONE 11a – this is fixed in version (11.0.1.1880)
· Veeam ONE 12 – this is fixed in version (12.0.1.2591)
What can I do?
Black Arrow recommends applying the patches for the vulnerabilities immediately due to the severity of the vulnerability; there is no workaround available. Further information can be found in the Veeam security update below.
Technical Summary
CVE-2023-38547 – If exploited this allows an unauthenticated attacker to gain information from the SQL server to access its configuration database. This can lead to an attacker to perform remote code execution.
CVE-2023-38548 – If exploited this allows an unprivileged user who has access to the Veeam One Web client to acquire NTLM hash of the account user, allowing them to obtain the users password.
Further information can be found here: https://www.veeam.com/kb4508
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 09 November 2023 – Critical Atlassian Vulnerability Actively Exploited
Black Arrow Cyber Advisory 09 November 2023 – Critical Atlassian Confluence Vulnerability Actively Exploited
Executive summary
Atlassian has published a security advisory warning users of an active exploitation of a critical vulnerability in all versions of Atlassian Confluence Data Center and Server, which could allow an unauthenticated attacker to perform actions with administrative functions. The vulnerability has been added to the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog.
What’s the risk to me or my business?
There is a risk that organisations operating a vulnerable version are leaving themselves at risk of allowing an unauthenticated attacker to reset confluence and create an administrator account. Atlassian has stated that exploitation can lead to a full loss of confidentiality, integrity and availability. This vulnerability affects all versions of Atlassian Confluence Data Center and Server.
What can I do?
Black Arrow recommends following Atlassian’s advice and applying updates immediately, which can be found in their advisory linked below. Atlassian have stated that publicly accessible Confluence Data Center and Server versions in particular, are at critical risk of exploitation.
In the event that you are unable to apply the updates, mitigations have been provided by Atlassian, however updates should be applied as soon as possible. The fixed versions of Confluence Data Center and Server are as follows:
7.19.16
8.3.4
8.4.4
8.5.3
8.6.1
Technical Summary
CVE-2023-22518- An improper authorisation vulnerability in Atlassian Confluence Data Center and Server.
Need help understanding your gaps, or just want some advice? Get in touch with us.
Further information can be found here:
https://nvd.nist.gov/vuln/detail/CVE-2023-22518
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Alert 27 October 2023 – Phishing Campaign Spoofing GFSC Targeting Guernsey Financial Services Firms
Black Arrow Cyber Alert 27 October 2023 – Phishing Campaign Spoofing GFSC Targeting Guernsey Financial Services Firms
Executive summary
We are aware of an active phishing campaign which is spoofing the Guernsey Financial Services Commission’s email domain. The official domain is gfsc.gg. Threat actors are impersonating this, and so far have been recorded as using gg-gfsc.com and/or g-gfsc.com. If you have received an email from the commission and are unsure of its authenticity do not click any links or attachments and forward it to phishing@gfsc.gg.
What’s the risk to me or my business?
Cyber attackers are utilising deceptive email domains that closely resemble the official commission's email domain to conduct phishing attacks. Falling victim to such attacks can lead to unauthorised access, data breaches, financial loss, and damage to the reputation of the affected party. The only domain used by the GFSC is gfsc.gg.
What can I do?
Black arrow recommends being extra vigilant when dealing with emails from the GFSC, if you are unsure of its authenticity do not click on any links or attachments and forward the email to phishing@gfsc.gg.
Further information and guidance can be found here:
https://www.gfsc.gg/news/spoof-emails-1
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatalert #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 26 October 2023 – Citrix Bleed Vulnerability Actively Exploited, Patch Now
Black Arrow Cyber Advisory 26 October 2023 – Citrix Bleed Vulnerability Actively Exploited, Patch Now
Executive summary
A high-serverity vulnerability in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) is being actively exploited in the wild. The vulnerability, labelled “Citrix Bleed” allows attackers to retrieve authentication tokens, which can then be used to gain unauthorised access to the user accounts. Following a release of a proof-of-concept, there has been a further rise in attackers exploiting the vulnerability, which has now been added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog. A second vulnerability, which causes a denial of service has also been addressed.
What’s the risk to me or my business?
Successful exploitation of the critical vulnerability allows an unauthenticated attacker to gain access to sensitive information which can then be used to access user accounts, impacting the confidentiality, integrity and availability of data. The second vulnerability can cause a denial of services, impacting the availability of data.
The following customer-managed versions are affected:
NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15
NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19
NetScaler ADC 13.1-FIPS before 13.1-37.164
NetScaler ADC 12.1-FIPS before 12.1-55.300
NetScaler ADC 12.1-NDcPP before 12.1-55.300
Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL) and a patch has not been released for these affected products.
What can I do?
Patches are available for impacted versions of NetScaler ADC and NetScaler Gateway. Due to the severity of the vulnerability Black Arrow recommends applying the patches for the critical vulnerability immediately. In addition, NetScaler have also provided a list of commands which can be used to kill active and persistent sessions, these can be found at the bottom of our advisory. These patches will also address the second vulnerability. NetScaler have noted that If you are a Citrix-managed cloud service or Citrix-managed Adaptive Authentication customer, no action is required.
Technical Summary
CVE-2023-4966 – This vulnerability if exploited allows an attacker to retrieve the authentication session cookies by performing an unauthenticated buffer related exploit which can allow the attacker to use the stolen session top log into the users ID.
CVE-2023-4967 – a vulnerability which if exploited, allows an attacker to cause a denial of service.
Further information on the Citrix patches can be found here:
Further information on the proof-of-concept can be found here:
https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 26 October 2023 – High Severity Vulnerability in VMware vCenter Patched, Including End-of-Life Products
Black Arrow Cyber Advisory 26 October 2023 – High Severity Vulnerability in VMware vCenter Patched, Including End-of-Life Products
Executive summary
VMware have released a security advisory addressing a vulnerability which could allow an attacker to perform to perform remote code execution via VMware vCenter Server. Patches have been released, even for previously end-of-life versions of VMware vCenter Server due to the severity of the vulnerability. VMware have also addressed a vulnerability in which information can be partially disclosed.
What’s the risk to me or my business?
Organisations with a vulnerable server are leaving themselves at risk of allowing an attacker to perform remote code execution, impacting the confidentiality, integrity and availability of data.
The following versions are vulnerable, with patches detailed in VMware’s response matrix: 8.0, 7.0, 5.x, 4.x. Additionally, VMware have noted that whilst VMware does not mention end-of-life products in VMware Security Advisories, due to the critical severity of this vulnerability and lack of workaround VMware has made a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x. For the same reasons, VMware has made additional patches available for vCenter Server 8.0U1.
What can I do?
Black Arrow recommends applying the patches for the critical vulnerability immediately due to the severity of the vulnerability; there is no workaround available. Fixes for the other vulnerability are addressed in the patches for the critical vulnerability. Further information can be found in the security advisory by VMware.
Technical Summary
CVE-2023-34048- A critical out-of-bounds write vulnerability which can lead to remote code execution.
CVE-2023-34056- a vulnerability which can allow threat actors without administrator privileges to access sensitive data.
Need help understanding your gaps, or just want some advice? Get in touch with us.
Further information can be found here: https://www.vmware.com/security/advisories/VMSA-2023-0023.html
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 19 October 2023 – Oracle Patches 185 Vulnerabilities in October 2023
Black Arrow Cyber Advisory 19 October 2023 – Oracle Patches 185 Vulnerabilities in October 2023
Executive Summary
Oracle's October 2023 Critical Patch Update comprises of 387 new security patches, addressing vulnerabilities both in Oracle's proprietary code and third-party components. This includes over 40 patches that address critical severity flaws and more than 200 patches designed to fix vulnerabilities exploitable remotely without authentication. The most patched Oracle products are Financial Services Applications, receiving 103 patches followed by Oracle communications with 91 patches.
What’s the risk to me or my business?
Due to the large number of patches, especially those fixing critical- severity and remotely exploitable flaws, underscores the potential risks associated with running unpatched Oracle products. Organisations using these products may face threats to data confidentiality, integrity, and availability if the vulnerabilities are exploited. The risk is especially pronounced for products such as Financial Services Applications and Oracle Communications, which have a high count of patches addressing remotely exploitable flaws without authentication.
Affected Products
Oracle's October 2023 CPU encompasses a broad range of affected products. Notably, these include Analytics, Retail Applications, Database Server, Communications Applications, Commerce, GoldenGate, Enterprise Manager, Java SE, PeopleSoft, E-Business Suite, Construction and Engineering, Systems, Utilities, Health Sciences Applications, Siebel CRM, Hyperion, Hospitality Applications, Essbase, REST Data Services, JD Edwards, Supply Chain, Secure Backup, TimesTen In-Memory Database, HealthCare Applications, and Insurance Applications. It's recommended that users of these solutions take note and act accordingly to ensure their systems remain secure.
What can I do?
Oracle has released security patches for all affected products and it is recommended for customers to implement the Critical Patch Update security patches immediately to mitigate potential threats. Oracle has also suggested to revisit any previous Critical Patch Update to ensure their software portfolio is up to date.
Need help understanding your gaps, or just want some advice? Get in touch with us.
Further information can be found here:
https://www.oracle.com/security-alerts/cpuoct2023.html
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Alert 17 October 2023 – Cisco IOS XE Software Web UI Zero-Day Under Active Exploitation - updated 20, 23, 24 & 25 October 2023
Black Arrow Cyber Alert 17 October 2023 – Cisco IOS XE Software Web UI Zero-Day Under Active Exploitation
Update 25/10/2023:
Another actively exploited zero-day has been found and is being used in the wild (CVE-2023-20273). Both exploits are now being used together to gain initial access and create a new local user, then to elevate privileges allowing the new user to have admin privileges on the system.
Links to the new CVE can be found below.
Update 24/10/2023:
The method of identifying compromised devices was updated and the number of compromised devices jumped back up to 38,000.
Patches have been made available by Cisco and should be applied as soon as possible.
Update 23/10/2023:
The number of compromised devices dropped sharply from 50,000 to 100 after Cisco disclosed the existence of the vulnerability as it appears that attackers modified the implant of the exploitation in an attempt to mask their activity.
Update 20/10/2013:
The number of Cisco devices hacked through exploitation of the zero-day has now reached approximately 40,000, according to multiple sources.
Executive summary
Cisco has published a security advisory warning users of an active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE software, which could allow an unauthenticated attacker to create an account with privileged exec mode enabled, allowing them full control. According to Shodan, there are 40,000 vulnerable devices with this vulnerability exposed online.
What’s the risk to me or my business?
There is a risk that organisations with a vulnerable device with the web UI feature exposed, are leaving themselves open to allowing an attacker full access of their Cisco device, impacting the confidentiality, availability and integrity of their data.
This vulnerability affects all Cisco devices that have the web UI feature enabled. The web UI feature is enabled through the ip http server or ip http secure-server commands. There is no patch currently available but Cisco have stated they are working on a fix. In the meantime as a mitigation Cisco strongly recommends that customers disable the HTTP Server feature on all internet-facing systems. To disable the HTTP Server feature, use the no ip http server or no ip http secure-server command in global configuration mode. If both the HTTP server and HTTPS server are in use, both commands are required to disable the HTTP Server feature.
What can I do?
Black Arrow recommends following Cisco’s advice and disabling the HTTP server feature. The commands can be found in Cisco’s security advisory which is linked below.
Technical Summary (updated 23/10/2023)
CVE-2023-20273 The vulnerability allows a malicious attacker to use an authenticated user, such as the one CVE-2023-20198 can create, to gain admin privileges to the system.
CVE-2023-20198 The vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with the highest privilege. The CVE has been given the maximum severity rating.
Need help understanding your gaps, or just want some advice? Get in touch with us.
Further information can be found here:
Further information on the number of exploited devices can be found here: https://www.securityweek.com/number-of-cisco-devices-hacked-via-unpatched-vulnerability-increases-to-40000/
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 12 October 2023 – Windows 11 21H2 and Windows Server 2012 Reach End of Support
Black Arrow Cyber Advisory 12 October 2023 – Windows 11 21H2 and Windows Server 2012 Reach End of Support
Executive summary
Multiple editions of Windows 11, version 21H2 and Windows Server 2021 have reached end of support. This means that Microsoft will no longer provide technical assistance or provide security updates.
What’s the risk to me or my business?
There is a risk that organisations who are not aware of this, or do not know if they use Windows 11 21H2 and or Windows Server 2012 operating systems, will be leaving themselves open to attack. Any vulnerability discovered will not have appropriate patches available and organisations will therefore be unable to patch against attacks.
What can I do?
Black Arrow recommends organisations check with their IT departments or their external IT provider/MSP whether relevant Windows 11 21H2 and or Windows Server 2012 operating systems are in place and if they are, then organisations need to move away from these as soon as they can.
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 12 October 2023 – Microsoft Patch Tuesday, Adobe and Chrome Updates Summary.
Black Arrow Cyber Advisory 12 October 2023 – Microsoft Patch Tuesday, Adobe and Chrome Security Updates Summary
Executive summary
Microsoft’s October 2023 Patch Tuesday provides updates to address 103 security issues across its product range, including two actively exploited zero-day vulnerabilities (CVE-2023-36563 and CVE-2023-41763). One of the exploited zero-day vulnerabilities is a privilege escalation vulnerability in skype. The other is an information disclosure vulnerability in Microsoft WordPad that can result in disclosure of NTLM hashes. Also among the updates provided by Microsoft were 13 critical vulnerabilities.
In addition to the Microsoft updates this week also saw Adobe fix 13 vulnerabilities across various products, with a vulnerability in Adobe Reader under active exploitation, and Google addressing 20 vulnerabilities in Chrome.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an attacker with access, to elevate privileges or capture the hashes of user passwords to gain access to that users accounts. Both compromise the confidentiality, integrity and availability of data stored by an organisation.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating.
Technical Summary
CVE-2023-36563: If exploited the vulnerability disclosures of information in Microsoft WordPad that could result in leak in NTLM hashes.
CVE-2023-41763: If actively exploited it allows for an attacker to escalate privileges in Skype that could lead to the exposure of sensitive information, such as IP addresses, port numbers and enabling an attacker to gain access to internal networks.
Adobe
This month, Adobe released fixes for 13 vulnerabilities, of which 8 were rated critical across Adobe Bridge (2), Commerce (10) and Photoshop (1). Adobe have stated a vulnerability in Adobe Reader is under active exploitation. The vulnerabilities include remote code execution, memory leak, privilege escalation and security bypass.
Chrome
An update for Google Chrome which patches 20 vulnerabilities, with the most severe allowing for arbitrary code execution to be performed by a malicious attacker. Depending on the privileges associated with the user an attacker could then install programs; view, delete or modify the data; or create new accounts with full user rights. Users whose accounts have fewer user rights could be less impacted than those who operate with administrative user rights. While there are currently no reports of these vulnerabilities being exploited in the wild, it is advised to update to the latest version as soon as possible.
further details on other specific updates within this patch Tuesday can be found here:
https://msrc.microsoft.com/update-guide/releaseNote/2023-Oct
Further details about CVE-2023-36563 can be found here:
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36563
Further details about CVE-2023-41763 can be found here:
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-41763
Further details of the vulnerabilities addressed in Adobe Bridge can be found here:
https://helpx.adobe.com/security/products/bridge/apsb23-49.html
Further details of the vulnerabilities addressed in Adobe Commerce can be found here:
https://helpx.adobe.com/security/products/magento/apsb23-50.html
Further details of the vulnerabilities addressed in Adobe Photoshop can be found here:
https://helpx.adobe.com/security/products/photoshop/apsb23-51.html
Further details of the vulnerabilities addressed in Chrome can be found here:
https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 05 October 2023 – Apple Release Emergency Patch for Two Zero-day Vulnerabilities, Taking Total to 17 Zero-days So Far in 2023
Black Arrow Cyber Advisory 05 October 2023 – Apple Release Emergency Patch for Two Zero-day Vulnerabilities, Taking Total to 17 Zero-days So Far in 2023
Executive Summary
Apple have released emergency updates to patch two zero-day vulnerabilities, including one actively exploited vulnerability, which target iPhone and iPad devices. The vulnerabilities allow an attacker to escalate privileges and perform remote code execution.
What’s the risk to me or my business?
Exploitation allows an attacker to elevate their privileges to the highest available and perform code execution. This allows attackers to perform actions such as extracting messages, photos, emails, and recording calls, impacting the confidentiality, integrity and availability of data.
Patches are available for:
iPhone XS and later
iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later
Technical Summary:
CVE-2023-42824- A kernel vulnerability allowing local attackers to escalate privileges on vulnerable iPhones and iPads. This vulnerability has been exploited against versions of iOS before 16.6.
CVE-2023-5217 – A heap buffer overflow weakness in libvpx which could allow code execution.
What can I do?
Users are recommended the apply the patches immediately, due to the active exploitation in the wild. Organisations should also be aware that the patches mean employees using Apple BYOD devices will need to apply the relevant patches, as this impacts corporate information which the devices have access to.
Further information can be found below:
Black Arrow Cyber Advisory 29 September 2023 – Billions of Usernames and Passwords Leaked Online And Major Charities Hit by Cyber Attack
Black Arrow Cyber Advisory 29 September 2023 – Billions of Usernames and Passwords Leaked Online And Major Charities Hit by Cyber Attack
Executive Summary
The usernames and passwords of billions of users have been exposed online after a company, DarkBeam left an online database unprotected. It’s worth noting that all of the leaked email addresses and passwords in this database actually came from previous data breaches. It appears DarkBeam had been collecting this information to alert its customers in regards to future data breaches.
This comes as a number of major charities have been impacted by a cyber attack on in which the supply chain of About Loyalty, who work with a number of charities, had been breached. As a result, a significant amount of donor information had been exfiltrated.
What’s the risk to me or my business?
The leaked usernames and passwords can be used by threat actors as attempts to perform account compromise or to conduct phishing campaigns. Similarly, the donor information related to the charity attacks can be used to perform phishing attacks. In both cases, the confidentiality and integrity of data can be impacted.
What can I do?
As always, Black Arrow recommend users stay vigilant and scrutinise anything that comes into their inbox.
To find out if your email address or password has featured in a data breach, you can visit:
More information on the leaked passwords can be found here:
More information on the charity breach can be found here:
https://www.thirdsector.co.uk/major-charities-affected-cyber-attack/digital/article/1838552
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 28 September 2023 – Critical Exploits for On Premise Version of Microsoft SharePoint
Black Arrow Cyber Advisory 28 September 2023 – Critical Exploits for On Premise Version of Microsoft SharePoint
Executive Summary
Researchers who discovered two critical vulnerabilities in Microsoft SharePoint Server have released details of an exploit which chains the two together to allow an attacker to enable remote code execution on affected servers. One of the vulnerabilities, which has had a proof of concept released this week, allows a malicious attacker to gain administrator privileges from a non-privileged account. The other vulnerability allows the attacker to execute arbitrary code on SharePoint servers. Microsoft has issued patches that address these vulnerabilities in its monthly security update for May and June.
Technical Summary
CVE-2023-29357 – This is a critical vulnerability which allows an attacker to use spoofed JWT authentication tokens to bypass authentication and allow them to gain access to the privileges of an authenticated user. The attacker does not need any privileges to execute this vulnerability.
CVE-2023-24955 – This is a critical vulnerability which allows an attacker to execute arbitrary code on the vulnerable SharePoint servers.
What’s the risk to me or my business?
The vulnerabilities when chained together allows an attacker to elevate to a privileged account and perform remote code execution. This gives an attacker the ability to distribute malicious files, links, and emails to users. This access allows to attacker to compromise the confidentiality, integrity, and availability of the data in your organisation.
The impacted on-premises products include the following:
SharePoint Server 2019
SharePoint Server 2016
SharePoint Server Subscription Edition
What can I do?
Microsoft have released patches for these vulnerabilities in its monthly security update for May and June. They also advise that if there are multiple updates available to apply all updates available to ensure that the product is secure.
More information on the SharePoint Server Remote Code Execution Vulnerability:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955
More information on the SharePoint Server Elevation of Privilege Vulnerability:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 28 September 2023 – Apple macOS 14 Sonoma Patches 60 Vulnerabilities
Black Arrow Cyber Advisory 28 September 2023 – Apple macOS 14 Sonoma Patches 60 Vulnerabilities
Executive Summary
Earlier this week Apple announced the release of macOS 14 Sonoma. A security update from Apple shows that the latest version of this patches more than 60 vulnerabilities.
What’s the risk to me or my business?
The vulnerabilities can be exploited to obtain sensitive information, execute code, elevate privileges, bypass security and modify the file system. All of which impact the confidentiality, integrity and availability of a vulnerable device. Patches are available for:
Mac Studio (2022 and later)
iMac (2019 and later)
Mac Pro (2019 and later)
Mac mini (2018 and later)
MacBook Air (2018 and later)
MacBook Pro (2018 and later)
iMac Pro (2017)
What can I do?
The update should be applied as soon as possible. Organisations should also be aware that the the vulnerabilities will impact employees with Apple BYOD as these devices will have access to corporate information.
Further information can be found below:
https://support.apple.com/en-us/HT213940
https://www.securityweek.com/macos-14-sonoma-patches-60-vulnerabilities/
Black Arrow Cyber Advisory 28 September 2023 – Google Patches Actively Exploited Chrome Zero Day as Mozilla Fix High-Severity Vulnerabilities in Firefox and Thunderbird
Black Arrow Cyber Advisory 28 September 2023 – Google Patches Actively Exploited Chrome Zero Day as Mozilla Fix High-Severity Vulnerabilities in Firefox and Thunderbird
Executive summary
A new actively exploited zero-day vulnerability in Google Chrome which can lead to remote code execution has been identified, with patches released. Also this week, Mozilla released updates for high-severity vulnerabilities in both Firefox and Thunderbird.
What’s the risk to me or my business?
The actively exploited vulnerability and high-severity vulnerabilities can allow an attacker to execute malicious code, compromising the confidentiality, integrity and availability of data.
What can I do?
Security updates are available for both browsers. The updates for Chrome are available in version 117.0.5938.132 and should be applied immediately. The updates for Firefox are available in version 118 and should be applied as soon as possible.
Technical Summary
CVE-2023-5217: an actively exploited zero-day heap-based buffer overflow which can lead to execution of arbitrary code.
The security advisory from Google Chrome can be found here:
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
The security advisory from Firefox can be found here:
https://www.mozilla.org/en-US/security/advisories/mfsa2023-41/
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 15 September 2023 – Critical Vulnerability in Multiple Browsers, Update Now
Black Arrow Cyber Advisory 15 September 2023 – Critical Vulnerability in Multiple Browsers and Applications Exploited, Update Now
Executive summary
A critical vulnerability in WebP has been identified as being actively exploited. The vulnerability impacts multiple browsers including Chrome, Edge, Firefox and Opera and any software using the libwebp library. Successful exploitation can lead to malicious code execution.
What’s the risk to me or my business?
The actively exploited vulnerability can allow an attacker to execute malicious code on vulnerable software, compromising the confidentiality, integrity and availability of data.
What can I do?
Security updates are available for browsers impacted; these should be applied immediately. It has been noted that other applications which use the libwebp library are also impacted and it is recommended that organisations check if the software they use is vulnerable.
Technical Summary
CVE-2023-4863: The actively exploited vulnerability allows an attacker to perform a heap buffer overflow attack, allowing them to execute malicious code.
Further details on the vulnerability can be found here:
https://nvd.nist.gov/vuln/detail/CVE-2023-4863
https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
The security advisory from Google Chrome can be found here:
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
The security advisory from Firefox can be found here:
https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
The security advisory from Microsoft can be found here:
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-4863
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 13 September 2023 – Microsoft Patch Tuesday fixes 59 Vulnerabilities, including Two Actively Exploited, also Adobe, Chrome, Mozilla and SAP Updates
Black Arrow Cyber Advisory 13 September 2023 – Microsoft Patch Tuesday fixes 59 Vulnerabilities, including Two Actively Exploited, also Adobe, Chrome, Mozilla and SAP Updates
Executive summary
Microsoft’s September Patch Tuesday provides updates to address 59 security issues across its product range, including two actively exploited zero-day vulnerabilities. The exploited zero-days have both been added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) “Known Exploited Vulnerabilities Catalog”. Of the 59 security issues addressed by Microsoft , 5 were rated critical.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an attacker to gain SYSTEM privileges or capture and relay hashes of user passwords to gain access to that users account. Both compromise the confidentiality, integrity and availability of data stored by an organisation.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerabilities and all other vulnerabilities that have a critical severity rating.
Technical Summary
CVE-2023-36802: The actively exploited allows a local attacker to gain SYSTEM privileges.
CVE-2023-36761: This actively exploited vulnerability can allow an attacker to steal user password NTLM hashes of users who open a document, even if just in the preview plane.
Adobe
This month, Adobe released fixes for 5 vulnerabilities, including 1 critical vulnerability, across Adobe Acrobat & Reader (1), Adobe Connect (2) and Adobe Experience Manager (2). The critical vulnerability, tracked as CVE-2023-26369, impacts both Windows and macOS versions of Adobe Acrobat & Reader and if exploited, can allow an attacker to execute malicious code.
Chrome
A new update for Google Chrome is available for Windows, Linux and macOS. The update addresses 16 security fixes, including one critical and actively exploited vulnerability which could cause for denial of service or allow code execution.
Mozilla
Mozilla released fixes for two critical vulnerabilities, impacting Firefox and Thunderbird. The vulnerabilities could allow an attacker to perform code execution.
SAP
Enterprise software vendor SAP has addressed 13 vulnerabilities in several of its products, including two critical-severity vulnerabilities that impact SAP BusinessObjects Business Intelligence Platform. 66Including remote execution and authentication bypass. A total of 5 vulnerabilities were given the “Hot News” priority, which is the highest priority according to SAP.
further details on other specific updates within this patch Tuesday can be found here:
https://www.ghacks.net/2023/09/12/the-windows-september-2023-security-updates-are-now-available/
Further information on Adobe Acrobat and Reader can be found here:
https://helpx.adobe.com/security/products/acrobat/apsb23-34.html
Further information on Adobe Connect can be found here:
https://helpx.adobe.com/security/products/connect/apsb23-33.html
Further information on Adobe Experience Manager can be found here:
https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html
Further information on the patches by SAP can be found here:
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10
Further information on Google Chrome can be found here:
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
Further information on Mozilla can be found here:
https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 08 September 2023 – Apple Discloses 2 New Zero-days Actively Exploited to Attack iPhones and Macs
Black Arrow Cyber Alert 08 September 2023 – Apple Discloses 2 New Zero-days Actively Exploited to Attack iPhones and Macs
Executive Summary
Apple have released emergency updates to fix two actively exploited new zero-day vulnerabilities which target iPhone and Mac users. The vulnerabilities, if exploited on an unpatched Apple device, allow attacks to execute arbitrary code through the use of maliciously crafted images and attachments.
What’s the risk to me or my business?
Exploitation of the vulnerabilities has already been used as part of zero-click iMessage exploits to deploy Pegasus mercenary software. This allows attackers execute code to perform actions such as extracting messages, photos, emails, and recording calls, impacting the confidentiality, integrity and availability of data.
Patches are available in:
macOS Ventura 13.5.2: Available for devices running macOS Ventura.
iOS 16.6.1 and iPadOS 16.6.1: Available for iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later.
Technical Summary:
CVE-2023-41064 – A buffer overflow weakness that when processing maliciously crafted images, can lead to arbitrary code execution
CVE-2023-41061 – a validation issue which can be exploited through a malicious attachment to also gain arbitrary code execution
What can I do?
Users are recommended the apply the patches as soon as possible due to their active exploitation in the wild. Organisations should also be aware that the patches mean employees using Apple BYOD devices will need to apply the relevant patches, as this impacts corporate information which the devices have access to.
Further information can be found below: