Publications

AUSCERT Week in Review for 20th March 2020 Greetings, Given the current ever-evolving situation with COVID-19 and the advice from our State and Federal Governments; in support of the health and wellbeing of our stakeholders we wanted to let you know that the AUSCERT2020 Conference has now been postponed. The Conference will now take place on 15th – 18th September 2020. A reminder that our member incident hotline continues to operate 24/7 and details can be found on our website by logging in to our member portal. In other news this week, our Principal Analyst wrote a blog on the various COVID-19 cyber threats we’re seeing out there. It’s unfortunate that this happens at a time when the community is already vulnerable! Read more about it here and be sure to check out his recommendations. Last but not least, we are pleased to share with you a copy of our 2019 Year in Review publication which provides members (and the general public) with a summary of our state-of-the-union, statistics from our range of services, achievements and milestones as well as details of our goals for 2020 and beyond. COVID-19 Cyber Threats: Observations, OSINT and Safety Recommendations Date: 2020-03-18 Author: AUSCERT AUSCERT have been made aware from either direct reports or via OSINT research that related threats have been seen relating to emails, mobile apps, web-applications; and social engineering scams. The purpose of this blog post is to: – Remind readers that it is common for threat actors to use the most compelling or big news topics of the times to be used in malspam attacks to incite their targets to open a crafted attachment linked to a website. – Inform readers of the various vectors or attack angles that threat actors have deployed using COVID-19 as their theme so they (organisations) can make informed decisions and take appropriate actions. A Critical Internet Safeguard Is Running Out of Time Date: 2020-03-16 Author: WIRED Keeping the internet safe may sometimes feel like a game of Whac-A-Mole, reacting to attacks as they arise, then moving on to the next. In reality, though, it’s an ongoing process that involves not just identifying threats but grabbing and retaining control of the infrastructure behind them. For years a small nonprofit called Shadowserver has quietly carried out a surprisingly large portion of that work. But now the organization faces permanent extinction in a matter of weeks. There’s a pivotal scene in Ghostbusters in which Environmental Protection Agency inspector Walter Peck marches into the group’s headquarters, armed with a cease and desist order. “Shut this off,” Peck tells the utility worker accompanying him. “Shut this all off.” They cut power to the Ghostbusters’ protection grid, and all the ghosts are released. Think of Shadowserver as the internet’s protection grid. For more than 15 years, Shadowserver has been funded by Cisco as an independent organization. But thanks to budget restructuring, the group now has to go out on its own. Rather than seek a new benefactor, founder Richard Perlotto says the goal is for Shadowserver to become a fully community-funded alliance that doesn’t rely on any one contributor to survive. The group needs to raise $400,000 in the next few weeks to survive the transition, and then it will still need $1.7 million more to make it through 2020—an already Herculean fundraising effort coinciding with a global pandemic. They’ve set up a page for both large corporate donations and smaller individual contributions. Exploring Various Ways in Which Hackers Are Milking the COVID-19 Scare Date: 2020-03-13 Author: Cyware Hackers have a history of sabotaging and manipulating public emergencies for their own gains. Imagine how tempting an epidemic like Coronavirus disease (COVID-19) would be for the crooks. Recently, hackers have run several attack campaigns across various countries, taking advantage of the spread of the disease. Microsoft releases patches for leaked, wormable ‘SMBGhost’ flaw Date: 2020-03-13 Author: IT News Microsoft has rushed out security updates for a remotely exploitable vulnerability in the Windows System Message Block version 3 file sharing protocol that researchers said could be abused to create self-spreading “worms” like the 2017 WannaCry malware. Adobe Fixes Nine Critical Vulnerabilities in Reader, Acrobat Date: 2020-03-17 Author: Bleeping Computer Adobe has released security updates for Adobe Acrobat and Adobe Reader that fix numerous vulnerabilities ranging from information disclosure to arbitrary code execution. Adobe usually releases security updates in conjunction with Microsoft’s Patch Tuesday security updates, but this month nothing was released at that time. ESB-2020.0975 – Security Bulletin for Adobe Acrobat and Reader | APSB20-13 Security updates for Adobe Acrobat and Adobe Reader for vulnerabilities ranging from information disclosure to arbitrary code execution. ESB-2020.0942.2 – VMware Security Advisories – VMSA 2020-0005 VMware security updates to address privilege escalation and denial-of-service (DoS) in the VMware Workstation, Fusion, VMware Remote Console and Horizon Client. Stay safe, stay patched and have a good weekend! Mal

COVID-19 Cyber Threats: Observations, OSINT and Safety Recommendations Here at AUSCERT, we have been regularly covering appropriate COVID-19 (aka coronavirus) articles and its development in the various editions of our AUSCERT Daily Intelligence Report (ADIR) and Week in Review (WIR) emails.  The purpose of this blog post is to:  Remind readers that it is common for threat actors to use the most compelling or big news topics of the times to be used in malspam attacks to incite their targets to open a crafted attachment linked to a website. Inform readers of the various vectors or attack angles that threat actors have deployed using COVID-19 as their theme so they (organisations) can make informed decisions and take appropriate actions. AUSCERT have been made aware from either direct reports or via OSINT research that related threats have been seen relating to emails, mobile apps, web-applications; and social engineering scams. Some articles have pointed to the need for minitoring anomalous remote access attempts. Summary of general recommendations AUSCERT’s recommendations to aid resilience during these times of COVID-19 themed attacks are as follows: Avoid clicking on promotional links in emails Beware of COVID-19 related phishing schemes and fake alerts/health advisories Don’t click on baits such as an “80% discount on an exclusive cure” or “treatment for coronavirus“ Enforce multi-factor authentication where possible If there is some general information that can be found searching through an online search, do that instead of clicking the link from a suspicious sender. If unsure about the authenticity of a website, don’t proceed with any login procedures Log all remote access events Monitor data exfiltration points Monitor for land speed anomalies or credential sharing Monitor remote access devices Organisations should ensure VPN and RDP servers are up-to-date Detail In more detail, we reiterate that COVID-19 as the latest trending news has been no exception to the trend of opportunistic crime. When threat actors consider which lures to use on their campaigns; it is no wonder that any related permutation of an event relating to COVID-19 will likely be very attractive.   Emails AUSCERT has been made aware of Australian organisations receiving malspam related to COVID-19 as a subject header. Some (non exhaustive) examples include:  Working from home statements from supervisors Recommendations to avoid infection Statements from Health Authorities (World, Federal, State or Employment related) One recent example showed an email disguised to be from the Director of Milan University surfaced in the pretense of steps to be undertaken to prevent further spread of the virus. The threat actor motivation became clear when a malicious URL link asked for the user login details and password.  Another sophisticated attack method that researchers reported contained an MS Word document from the World Health Organisation with an embedded URL that lead to a fake MS Office website.   Web applications Threat actors are cloning, impersonating or crafting websites to facilitate their COVID-19 related scams. Researchers have found that more than 4000 COVID-19 related domains were registered globally. Of those, around 5% could be malicious and an additional 5% are suspicious. A recent example as reported by industry journalists from security organisations and featured in a recent edition of our ADIR;  stated that a clone of the (legitimate) Johns Hopkins University coronavirus map was used to spread malware. This is a call for people to be careful about which websites to trust.  In addition to this, security researchers at Malwarebytes reported finding malicious code hiding behind the fake website that claimed to have the look-and-feel of the legitimate map yet able to show an up-to-date global heatmap of COVID-19 reports.  Malwarebytes reported that the malicious code skims for passwords and credit card details, as a variant of the AzorUlt spyware. Advice is to be sure to only use trusted AND verified information sources from government and research institution’s websites.   Social Media Social media users need to be wary of two specific scams that are likely to play off the current COVID-19 situation. The first is fake fundraising initiatives. “Fundraising” threat actors will use stories and images of real people to tap into society’s pathos. Notably, these scammers will utilise legitimate fundraising platforms like GoFundMe to solicitate donations. Be cautious of any individuals asking for donations. The second threat for COVID-19 related scams deals with investments. As the Securities and Exchange Commission (SEC) recently warned, criminals will use social media to promote microcap stocks which they claim have a product or service that can help prevent or treat COVID-19 patients. These are what is known in industry as pump-and-dump scams that could cost investors a lot of money. Be sure to perform some independent research. A quick search will help clear any cloudiness about the proposed investment. In conclusion, stay alert on social media. Even though these websites are intended for social interactions and help people connect to each other in times of need, stay conscious when scrolling through your news feed.   Malware and mobile apps Lures of downloading mobile apps related to COVID-19 have also turned into a suspicious platform.  The use of these tactics have been seen to be used at every level of the threat actors and encompasses the spreading of a well-known set of malware. It is important to ensure that a high level of vigilance is used on any related malspam. This is even more so for any workforce that is going to be working from home as there may be further limited channels to cross check statements from emails. Recorded Future recently observed an extensive list of actors and malware employing various techniques’ including Trickbot, Lokibot, and Agent Tesla, targeting a broad set of victims, including those in the USA, Italy, Ukraine, and Iran in particular. Threat actors have also endeavoured to gain the trust of victims using branding associated with the U.S. Centres for Disease Control and Prevention (CDC) and the World Health Organization (WHO), as well as country-specific health agencies such as the Public Health Centre of the Ministry of Health of Ukraine and China’s Ministry of Health, and companies such as FedEx. COVID-19 Android ransomware application such as Covidlock have impacted individuals and has been subject of industry analysis. The Covidlock application was named as such because of the malware’s capabilities and its background story. It uses techniques to deny the victim access to their phone by forcing a change in the password used to unlock the phone. This is also known as a screen-lock attack and has been seen before on Android ransomware. Please ensure that you download mobile applications only from official stores (Apple/Android). There is a much higher risk of downloading malware from untrusted 3rd party stores.   Phishing kits Often the COVID-19 campaigns are highly convincing due to cyber criminals using professional phishing kits. For example, these kits are programmed to use perfectly matched logos and email formats of legitimate organisations. Additionally, threat actors will incorporate “combosquatting” and “typosquatting” tactics to fool users into thinking the link is legitimate. One example of typosquatting is when an attacker uses popular domains that are misspelled incorrectly but look like real a domain name. For example, faecbook.com or wellsfagro.com. Combosquatting and typosquatting have similar tactics used to fool users, however, the domain name is appended with -security. For example, wellsfargo-security.com or security-chase.com. Notice the domains are not misspelled but prepended or appended with the word security.   Phone and text messages Threat actors are already impersonating the UN’s health agency to carry out a variety of scams, from account takeovers to phony donation requests and the spread of malware. The FTC is also warning of spoofed emails, text messages, and phone calls that claim to be from the Centre for Disease Control (CDC).   Advanced Persistent Threat (APT) Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current COVID-19 scare, in order to deliver a previously unknown malware implant to the target. This specific campaign leverages the COVID-19 pandemic to lure victims to trigger the infection chain. The attackers updated their toolset from documents with macros and older RTF exploits to the latest variation of the RoyalRoad RTF exploit-builder observed in the wild. By taking a closer look at the campaign, Checkpoint was able tie it to other operations which were carried out by the same anonymous group, dating back to at least 2016. Over the years, these operations targeted different sectors in multiple countries, such as Ukraine, Russia, and Belarus. Campaign IOCs We highly recommend readers review this report. Checkpoint provides a full analysis of the TTPs utilised throughout this campaign, the infrastructure, and the new tools they uncovered during their research, of what they believe to be a Chinese-based threat actor. Source: https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/   Royal Road – Specifics/IOCs Royal Road is an RTF weaponiser, sometimes called “8.t RTF exploit builder”. This tool is shared between multiple threat actors and is known to exploit: CVE-2017-11882 CVE-2018-0798 CVE-2018-0802 The RTF file has a various of characteristics that help with attribution. There are many threat actors who use Royal Road, of whom can be divided into three groups and suppose connections between actors. To review documented IOCS – see “Appendix-1: IOC” in the article that follows. Source: https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html   COVID-19 Scams: further industry analysis Wired published an interesting article associated with coronavirus phishing scams. “It’s not surprising that they would attempt to incorporate the coronavirus into that playbook so quickly. But the move illustrates how phishing attempts so consistently hew to certain time-tested topics and themes”. The article went on to describe that “the success rate of seasonally themed phishing emails pales in comparison, though, to those pegged to a critical world event. People living through Brexit uncertainty or a natural disaster have disproportionate questions and concerns. Attackers can exploit those fears and doubts by suggesting they have answers”. The takeaway is to always be aware that “email scammers often try to elicit a sense of fear and urgency in victims”. Source: https://www.wired.com/story/coronavirus-phishing-scams/   As of March 11, 2020 Recorded Future following their own analysis believe that COVID-19 has been primarily used by cybercriminals as a theme for phishing lures. However, they observed that at least three cases where reference to COVID-19 was leveraged by possible nation-state actors. They assessed that as the number of COVID-19 cases, as well as publicity around the virus rises globally, both cybercriminals and nation-state actors will increasingly exploit the crisis as a cyberattack vector.  They further assessed that: “Cybercriminals will often use the branding of “trusted” organisations in these phishing attacks, especially the World Health Organization, in order to build credibility and get users to open attachments or click on the link” “For the duration of the outbreak, COVID-19 will continue to be used as a lure, and that new versions of these lures targeting new countries will emerge” Their analysis is interesting reading and in-depth, therefore readers should consider reading the full analysis available via the following link. Source: https://www.recordedfuture.com/coronavirus-panic-exploit/ Now that we’ve covered a list of observations and OSINT findings above, let’s look at the following safety recommendations from ACSC, ASD and US-CERT:  Australian Gov: ACSC and ASD In their article Cyber security is essential when prepping for COVID-19, the ACSC suggested considerations should be made to incorporate a set of defined proactive strategies to address cyber threats, which include those associated with COVID-19, quoting the ASD:   “The Australian Signals Directorate (ASD) would like to remind you to incorporate cyber security into your contingency planning. As more staff may work from home, and the use of remote access technology increases, adversaries may attempt to take advantage. ASD’s Australian Cyber Security Centre (ACSC) encourages Australians to remain vigilant and ensure sound cyber security practices.” Source: https://www.cyber.gov.au/news/cyber-security-essential-when-preparing-covid-19   USA Gov: US-CERT Organisations should be vigilant to COVID-19 themed cyber threats and consider your enterprise VPN security as it relates to staff working remotely (teleworking). The Cybersecurity and Infrastructure Security Agency (CISA) warns individuals to remain vigilant for scams related to Coronavirus Disease 2019 (COVID-19). Cyber actors may send emails with malicious attachments or links to fraudulent websites to trick victims into revealing sensitive information or donating to fraudulent charities or causes. Exercise caution in handling any email with a COVID-19 related subject line, attachment, or hyperlink, and be wary of social media pleas, texts, or calls related to COVID-19. CISA encourages individuals to remain vigilant and take the following precautions: Avoid clicking on links in unsolicited emails and be wary of email attachments. See Using Caution with Email Attachments and Avoiding Social Engineering and Phishing Scams for more information. Use trusted sources—such as legitimate, government websites—for up-to-date, fact-based information about COVID-19. Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. Verify a charity’s authenticity before making donations. Review the Federal Trade Commission’s page on Charity Scams for more information. Review CISA Insights on Risk Management for COVID-19 for more information. Source: https://www.us-cert.gov/ncas/current-activity/2020/03/06/defending-against-covid-19-cyber-scams   US-CERT further addressed the case for enterprise VPN security within their security bulletin reference Alert (AA20-073A). As organisations prepare for possible impacts of Coronavirus Disease 2019 (COVID-19), many may consider alternate workplace options for their employees. Remote work options—or telework—require an enterprise virtual private network (VPN) solution to connect employees to an organisation’s information technology (IT) network. As organisations elect to implement telework, the Cybersecurity and Infrastructure Security Agency (CISA) encourages organisations to adopt a heightened state of cybersecurity. CISA encourages organisations to review the following recommendations when considering alternate workplace options Update VPNs, network infrastructure devices, and devices being used to remote into work environments with the latest software patches and security configurations. Alert employees to an expected increase in phishing attempts. Ensure IT security personnel are prepared to ramp up the following remote access cybersecurity tasks: log review, attack detection, and incident response and recovery. Implement MFA on all VPN connections to increase security. If MFA is not implemented, require teleworkers to use strong passwords. Ensure IT security personnel test VPN limitations to prepare for mass usage and, if possible, implement modifications—such as rate limiting—to prioritise users that will require higher bandwidths. Source: https://www.us-cert.gov/ncas/alerts/aa20-073a   Summary Individuals and organisations should expect to see a wide range of COVID-19 related phishing emails, smishing (text message phishing), and phone fraud scams over the coming weeks. These scams will focus on our insecurities about how the virus is spreading. The scams can take on several forms – for instance, fake health agency warnings about infections in your local area, vaccine and treatment offers, and alerts about critical supply shortages. In particular, individuals should avoid clicking on promotional links in emails. Don’t click on baits such as an “80% discount on an exclusive cure” or “treatment for coronavirus“ If unsure about the authenticity of a website, don’t proceed with any login procedures. If there is some general information that can be found searching through an online search, do that instead of clicking the link from a suspicious sender. Organisations should enforce multi-factor authentication where possible, and ensure VPN and RDP servers are up to date. IT/Security teams should log all remote access events and monitor data exfiltration points, monitor for land speed anomalies/credential sharing and monitor remote access devices. If there is any doubt to a received item, individuals should reach out to the appropriate teams within their organisations for reassurance. Organisations should be vigilant to COVID-19 themed cyber threats. Any organisation that believe they have been victim to a targeted attack should contact the ACSC.  And in turn, all AUSCERT member organisations know they can reach out to us here at AUSCERT for further assistance. We are here to help.   In the meantime during this time of change and challenge, please stay safe in both our physical and virtual worlds.   All the best, Colin Chamberlain CISSP Principal Analyst, AUSCERT   Other sources: https://www.grahamcluley.com/coronavirus-map-used-to-spread-malware/ https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-malware/ https://www.business2community.com/cybersecurity/coronavirus-covid-19-3-scams-to-watch-out-for-02293067 https://cointelegraph.com/news/covidlock-exploits-coronavirus-fears-with-bitcoin-ransomware https://twitter.com/hashtag/CovidLock?src=hash https://cyware.com/news/exploring-various-ways-in-which-hackers-are-milking-the-covid-19-scare-254d1f9b http://www.zumatech.com/email-spoofing-how-to-recognize-a-spoofed-email-message/ https://news.un.org/en/story/2020/02/1058381 https://www.domaintools.com/resources/blog/covidlock-mobile-coronavirus-tracking-app-coughs-up-ransomware https://cointelegraph.com/news/covidlock-exploits-coronavirus-fears-with-bitcoin-ransomware https://twitter.com/hashtag/CovidLock?src=hash

AUSCERT and the APCERT CYBER DRILL 2020 “BANKER DOUBLES DOWN ON MINING”   This year, AUSCERT took on a more proactive approach in the Asia Pacific region by taking on the lead role in coordinating this annual drill.  As the lead, AUSCERT created the scenario and orchestrated the creation of “the inject” – which are the prompts sent to all involved teams.  Of course, it goes without saying that the drill was not entirely AUSCERT’s contribution.   Contribution, either be it via infrastructure through ticketing systems; or communication as well as artefact creations came from various other national computer emergency response teams around the Asia Pacific. AUSCERT had the opportunity to lead these teams and coordinated the various resources to ensure that APCERT/CSIRT, as well as all invited partners and guest CERTs/CSIRTs spanning across the globe, through this cyber security drill are ready to cooperate in handling incidents as they come. Please see below for a copy of the official media release:      APCERT Secretariat: JPCERT/CCJapan Computer Emergency Response Team Coordination CenterContact: apcert-sec@apcert.orgURL: www.apcert.org   11 March 2020  MEDIA RELEASE  The Asia Pacific Computer Emergency Response Team (APCERT) today has successfully completed its annual drill to test the response capability of leading Computer Security Incident Response Teams (CSIRT) within the Asia Pacific economies. The theme of this year’s APCERT Drill is “Banker doubles down on Miner”. This exercise reflects real incidents and issues that exist on the Internet. The participants handled a case of a local business affected by malware infection which is triggered by data breach. Throughout the exercise, the participating teams activated and tested their incident handling arrangements. This drill included the need for the teams to interact locally and internationally, with CSIRTs/CERTs and targeted organizations, for coordinated suspension of malicious infrastructure, analysis of malicious code, as well as notification and assistance to affected entities. This incident response exercise, which was coordinated across many economies, reflects the collaboration amongst the economies in mitigating cyber threats and validates the enhanced communication protocols, technical capabilities and quality of incident responses that APCERT fosters in assuring Internet security and safety. 25 CSIRTs from 19 economies of APCERT (Australia, Bangladesh, Brunei Darussalam, People’s Republic of China, Chinese Taipei, Hong Kong, India, Indonesia, Japan, Korea, Lao People’s Democratic Republic, Macau, Malaysia, Myanmar, New Zealand, Singapore, Sri Lanka, Thailand, and Vietnam) participated in the drill. From the external parties, CSIRTs from 7 economies (Benin, Egypt, Jordan, Morocco, Nigeria, Pakistan and Tunisia) of OIC-CERT and AfricaCERT participated. About APCERT APCERT was established by leading and national Computer Security Incident Response Teams (CSIRTs) from the economies of the Asia Pacific region to improve cooperation, response and information sharing among CSIRTs in the region. APCERT Operational Members consist of 30 CSIRTs from 21 economies. Further information about APCERT can be found at: www.apcert.org/. ~ End ~ Original copy of this media release can be found HERE  

AUSCERT Week in Review for 13th March 2020 Greetings, We understand that this is a worrying time for many in our community and wanted to broach the subject of how COVID-19 (Coronavirus) impacts AUSCERT. Our team will continue to support our members through our range of services. A reminder that our member incident hotline continues to operate 24/7 and details can be found on our website by logging in to our member portal.  Because we are a part of The University of Queensland, we are aligning ourselves with the University by responding to the situation as it evolves and are also planning for contingencies to continue delivering our services. In other news this week, AUSCERT took part as the leading team in the annual Asia Pacific Computer Emergency Response Team (APCERT) drill. This drill tests the response capability of leading Computer Security Incident Response Teams (CSIRT) within the Asia Pacific economies. To find out more about this annual endeavour, please visit our site here. Last but not least, we are pleased to announce that our conference website is now updated with a list of speakers and program details will be announced soon. Microsoft emits SMBv3 worm-cure crisis patch Date: 2020-03-12 Author: The Register Microsoft has released an out-of-band emergency patch for a wormable remote-code execution hole in SMBv3, the Windows network file system protocol. On Thursday morning, Redmond emitted the update to Server Message Block 3.1.1 to kill off a critical flaw designated CVE-2020-0796. The bug can be exploited by an unauthenticated attacker to execute malicious code, at administrator level, on an un-patched system simply by sending the targeted system specially crafted compressed data packets. Systems running 32 and 64-bit Windows 10 v1903, Windows 10 v1909, Windows Server v1903 (Server Core), and Windows Server v1909 (Server Core) – and just those versions – need to get patched right now. Coronavirus map used to spread malware Date: 2020-03-09 Author: Graham Cluley Be careful about which websites you trust. A malicious site appears to have copied the look-and-feel of a legitimate Coronavirus map from Johns Hopkins University. Security researchers at Malwarebytes say that they have found malicious code hiding behind the fake website that claimed to show an up-to-date global heatmap of Coronavirus reports. The malicious code skims for passwords and payment card details, as a variant of the AzorUlt spyware. Be careful what programs you install and run on your computers folks… or you might be putting yourself at risk. Coronavirus: How hackers are preying on fears of Covid-19 Date: 2020-03-13 Author: BBC News Cyber-criminals are targeting individuals as well as industries, including aerospace, transport, manufacturing, hospitality, healthcare and insurance. Phishing emails written in English, French, Italian, Japanese, and Turkish languages have been found. The BBC has tracked five of the campaigns. March 2020 Patch Tuesday: Microsoft fixes 115 vulnerabilities, Adobe none Date: 2020-03-10 Author: Help Net Security It’s March 2020 Patch Tuesday, Adobe seems to have skipped releasing any patches, whilst Microsoft has dropped fixes for 115 CVE-numbered flaws: 26 are critical, 88 important, and one of moderate severity. The 26 critical flaws all allow remote code execution, but some are more easily exploited than others. The good news is that no active attacks have been observed for any of the vulnerabilities at this time. Preparing for Covid-19 and beyond Date: 2020-03-06 Author: Beta News The threat of a global pandemic is alarming, but at least in this case, IT has some advance notice to prepare for the worst-case scenario. You do not want to be caught without a plan if local governments institute a quarantine or local schools are closed for several weeks. And even if we avoid a pandemic — fingers crossed — the planning you did won’t be in vain. It’s important for every organization to always have a plan to deal with disasters large and small, whether it’s flooding, inclement winter weather or a particularly bad cold that sends half your team home. Here are the steps you should take to put together your plan and prepare for a potential pandemic. ESB-2020.0862.2 – UPDATED ALERT SMBv3: Execute arbitrary code/commands – Remote/unauthenticated Microsoft released an out-of-bounds emergency patch today for a vulnerability identified as wormable. See article above. ESB-2020.0868 – Firefox ESR: Multiple vulnerabilities Firefox update patches Airpod information disclosure vulnerability. ASB-2020.0054 – Windows: Multiple vulnerabilities Microsoft Patch Tuesday resolves 78 vulnerabilities for Windows. Stay safe, stay patched and have a good weekend! Sean

AUSCERT and the APCERT CYBER DRILL 2019   “Catastrophic Silent Draining in Enterprise Network”   Exactly a week a week ago, our team was involved in the 2019 APCERT Cyber Drill.    AUSCERT is proud to announce that we had some staff members as part of the running committee tasked with assisting the organization responsible for this drill and various other staff members as participants. Last but not least, AUSCERT will be running this drill next year in 2020 and the entire team is excited and looking forward to this opportunity.   Please see below for a copy of the official media release:      APCERT Secretariat: JPCERT/CCJapan Computer Emergency Response Team Coordination CenterContact: apcert-sec@apcert.orgURL: www.apcert.org   31 July 2019 MEDIA RELEASE The Asia Pacific Computer Emergency Response Team (APCERT) today has successfully completed its annual drill to test the response capability of leading Computer Security Incident Response Teams (CSIRT) within the Asia Pacific economies. The theme of this year’s APCERT Drill is “Catastrophic Silent Draining in Enterprise Network.” This exercise reflects real incidents and issues that exist on the Internet. This year’s scenario was inspired by a latest security attack on an organization, which relates to the vulnerability that could allow attackers to completely take over vulnerable websites to deliver malware backdoor and cryptocurrency miners. This drill included the need for the teams to interact locally and internationally, with CSIRTs/CERTs and targeted organizations, for coordinated suspension of malicious infrastructure, analysis of malicious code, as well as notification and assistance to affected entities. This incident response exercise, which was coordinated across many economies, reflects the collaboration amongst the economies in mitigating cyber threats and validates the enhanced communication protocols, technical capabilities and quality of incident responses that APCERT fosters in assuring Internet security and safety. Throughout the exercise, the participating teams activated and tested their incident handling arrangements.  This drill included the need for the teams to interact locally and internationally, with CSIRTs/CERTs and targeted organizations, for coordinated suspension of malicious infrastructure, analysis of malicious code, as well as notification and assistance to affected entities. This incident response exercise, which was coordinated across many economies, reflects the collaboration amongst the economies in mitigating cyber threats and validates the enhanced communication protocols, technical capabilities and quality of incident responses that APCERT fosters in assuring Internet security and safety. 26 CSIRTs from 20 economies of APCERT (Australia, Bhutan, Brunei Darussalam, People’s Republic of China, Chinese Taipei, Hong Kong, India, Indonesia, Japan, Korea, Lao People’s Democratic Republic, Macao, Malaysia, Mongolia, Myanmar, New Zealand, Singapore, Sri Lanka, Thailand, and Vietnam) participated in the drill. Original copy of this media release can be found HERE  

AUSCERT Week in Review for 6th March 2020 Greetings, Welcome to March. This month sees us turning 27. As an organisation, we have come a long way since the day that student hacked into NASA in their spare time in 1993! 27 years later, we are still preaching our greater good ethos and are proud to be serving our members daily. Soon, we will be sharing with you a copy of our Year in Review 2019 publication. This is something we have put together to help our members (and the public) understand the current trends in our industry – from AUSCERT’s unique perspective; it will also provide an oversight of our operations and offers a preview of our automation-focused road map for 2020 and beyond. Last but not least, Happy International Women’s Day to all our readers. To celebrate and pay homage to our female colleagues, AUSCERT will be featuring a Women of AUSCERT series on our LinkedIn page throughout next week. The Let’s Encrypt CAA Code Bug – A Plain View Date: 2020-03-05 Author: AUSCERT Blog Let’s Encrypt recently found a bug in their CAA checking code and after remediating the bug on 2020-02-29 UTC (the evening of Friday February 28, U.S. Eastern time), announced they would revoke approximately 2.6% of their active certificates that were potentially affected by the bug, totaling approximately 3 million certificates. Whilst this might not be seen as critical on the surface, a certificate is fundamentally used to establish and maintain site trustworthiness between two parties. Essentially, certificates are used by browsers to ensure that the site we intended to visit is really the one we’ve arrived at. Leaving a revoked certificate in-place could trigger errors in browsers and other applications, cause loss availability and/or trust, all potentially causing harm to the companies that rely on them. Social Engineering Risks: How to Patch the Humans in Your Organization Date: 2020-02-28 Author: PenTest Magazine Employees have long been presumed as the weakest link in the corporate cybersecurity chain. But new research from Proofpoint’s Human Factor report claims that over 99% of email-borne cyber-attacks require human intervention to work. Hackers are targeting primarily people, rather than technology systems, to get what they want. Technically anyone in your organization could be on the receiving end of such an attack. Organizations need to do better at protecting and educating these Very Attacked People (VAPs) in their midst. As always, a defense-in-depth approach makes the best sense. This should start with user awareness training and education, but not rely 100% on it. By adding in other steps, you stand a better chance of knocking back the hackers in the event that they manage to trick an employee or bypass a security solution. Citrix vulnerability used for potential Defence recruitment database access Date: 2020-03-04 Author: ZDNet The Australian Signals Directorate (ASD) has revealed that a vulnerability in Citrix, announced over Christmas, could have been used by malicious actors to access a database of Australian Defence recruitment details. “On the 24th of January … through sensitive other sources, had a concern that the Department of Defence and its contractor running the DFRN [Defence Force Recruiting Network] may have been vulnerable to a malicious act as a result of the Citrix issue,” newly installed director-general of the Australian Signals Directorate Rachel Noble told Senate Estimates on Wednesday night. Noble added that ASD believed no data was compromised, but it did see attempts to access the network related to the vulnerability. Fraud Prevention Month: How to protect yourself from scams Date: 2020-03-04 Author: WeLiveSecurity Businesses and citizens lead busy lives and it is very easy to keep items that may not immediately affect us towards the bottom of the to-do list. Fraud is potentially one of those items, we may appreciate it can happen but unless it’s happening to us at this moment in time then we can often be guilty of delaying preventative action. And for businesses the risk is compounded; fraud may affect the daily operations of the business and if it requires public disclosure can lead to loss of reputation and potentially create a distrust atmosphere with customers. Banking fraud and identity theft are intrinsically linked, as you would expect. Here are some tips on what should be the beginning of your plan to protect your identity. ASB-2020.0051 – Android: Multiple vulnerabilities The March 2020 patch level for Android includes fixes for multiple critical vulnerabilities. ESB-2020.0769 – zsh: Increased privileges The commonly-used zsh shell had a flaw in its –no-PRIVILEGED option. ESB-2020.0746 – Salt: Unauthenticated RCE A SecOps product fixed an unauthenticated command injection vulnerability. Stay safe, stay patched and have a good weekend! Sean & Mal

The Let's Encrypt CAA Code Bug – A Plain View What happened Let’s Encrypt recently found a bug in their CAA checking code and after remediating the bug [1] on 2020-02-29 UTC (the evening of Friday February 28, U.S. Eastern time), announced they would revoke approximately 2.6% of their active certificates that were potentially affected by the bug, totalling approximately 3 million certificates [2]. Let’s Encrypt company engineers provided a technical update [1]: “ On 2020-02-29 UTC, Let’s Encrypt found a bug in our CAA code. Our CA software, Boulder, checks for CAA records at the same time it validates a subscriber’s control of a domain name. Most subscribers issue a certificate immediately after domain control validation, but we consider a validation good for 30 days. That means in some cases we need to check CAA records a second time, just before issuance. Specifically, we have to check CAA within 8 hours prior to issuance (per BRs §3.2.2.8), so any domain name that was validated more than 8 hours ago requires rechecking. The bug: when a certificate request contained N domain names that needed CAA rechecking, Boulder would pick one domain name and check it N times. What this means in practice is that if a subscriber validated a domain name at time X, and the CAA records for that domain at time X allowed Let’s Encrypt issuance, that subscriber would be able to issue a certificate containing that domain name until X+30 days, even if someone later installed CAA records on that domain name that prohibit issuance by Let’s Encrypt. We confirmed the bug at 2020-02-29 03:08 UTC, and halted issuance at 03:10. We deployed a fix at 05:22 UTC and then re-enabled issuance. Our preliminary investigation suggests the bug was introduced on 2019-07-25. We will conduct a more detailed investigation and provide a postmortem when it is complete. “   Cert Revocation, Renewal and Replacement Let’s Encrypt report they are aiming to “complete revocations before the deadline of 2020-03-05 03:00 UTC, we are planning to start revoking affected certificates at 2020-03-04 20:00 UTC (3:00pm US EST)”. Those affected should continue to renew and replace affected with new certificates. [3]   Impact Whilst this might not be seen as critical on the surface, a certificate is fundamentally used to establish and maintain site trustworthiness between two parties.  Essentially, certificates are used by browsers to ensure that the site we intended to visit is really the one we’ve arrived at. Leaving a revoked certificate in-place could trigger errors in browsers and other applications, cause loss availability and/or trust, all potentially causing harm to the companies that rely on them.   Impacted Customer Communications From Let’s Encrypt Let’s Encrypted reported they “have sent notification emails to affected subscribers who have registered an email address”, although believe some customers “may not have received an email if they did not provide an email address while registering” their ACME account. [3] In this latter scenario, Let’s Encrypt are directing customers with any need to re-subscribe to email notifications to https://letsencrypt.org/docs/expiration-emails/ . [3] It is worth considering that email delivery issues or spam filtering may also be the cause of missing the email which ultimately advises affected customers to renew their certificates. [3]   If you are looking for the missing email you can search for the following subject line within your mailbox or email gateway logs: “ACTION REQUIRED: Renew these Let’s Encrypt certificates by March 4”   If you are unsure whether your hostname is affected, use the checking tools described in this post.   Via AUSCERT As a passionate not-for-profit CERT organisation, we routinely monitor industry updates, news and other intel feeds. Due to this practice, we were promptly aware of the public bug announcement from Let’s Encrypt and following a proactive course of action, we identified AUSCERT Members with affected certificates and are currently working with them.   Identifying an affected certificate Let’s Encrypt have published a page hosting the list of affected serial numbers relating to the 2020.02.29 CAA Rechecking Incident [3].  That page details the downloadable file contains a list of all affected certs, sorted by account ID. [4] Checking Tools/methods There are several methods or tools providing a means to check for an affected certificate. Online Common Tools Curl OpenSSL Purpose built script   Online If you want to double check whether a given hostname still needs its certificate replaced, you can use the tool seen in the screenshot below available at: https://checkhost.unboundtest.com/ .   Common Tools Curl The curl command on a linux system can be used in conjunction with online tool https://checkhost.unboundtest.com/ against a target website to show its current certificate serial number. The following two example indicate affected and non-affected certificate responses. Response 1: Affected Certificate $ curl -XPOST -d ‘fqdn=www.REDACTED.au’ https://checkhost.unboundtest.com/checkhost The certificate currently available on www.REDACTED.au needs renewal because it is affected by the Let’s Encrypt CAA rechecking problem. Its serial number is xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. See your ACME client documentation for instructions on how to renew a certificate. Response 2: Non-Affected Certificate $ curl -XPOST -d ‘fqdn=letsencrypt.org’ https://checkhost.unboundtest.com/checkhost The certificate currently available on letsencrypt.org is OK. It is not one of the certificates affected by the Let’s Encrypt CAA rechecking problem. Its serial number is 03a1c95bdaa36a8268327f2253cbd3ba2436   OpenSSL As seen in the following examples, the openssl command (linux) can be used against a target website to show its current certificate serial number: openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d : Response:         Serial Number             0fd078dd48f1a2bd4d0f2ba96b6038fe   openssl s_client -connect letsencrypt.org:443 -servername letsencrypt.org -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d : Response:         Serial Number             03a1c95bdaa36a8268327f2253cbd3ba2436   Purpose-Built Script Github – Let’s Encrypt CAA (lecaa) checking scripts [5] A purpose-built script hosted on Github [5] and created by Hanno Böck [6] “…allows you to efficiently check affected hosts”. Hanno Böck advised on his github page that the script was created after “Let’s Encrypt announced a bug in their system’s CAA checks, which forced them to revoke 3 million certificates on very short notice”.   Let’s Encrypt credit the lecaa script as useful tool and refer customer to use it by advising “if you have a large list of domains you need to check, this tool will be more effective. [3]   Where certificates are found that are not affected, Let’s Encrypt said “even if you received an email, it’s possible that the affected certificates have been replaced by newer certs not affected by the bug. (Either due to being issued in the last few days since it was fixed, or simply by not meeting the specific timing criteria necessary for the bug to trigger.) In that case, it’s not necessary to renew them again”. [3]   Questions Anyone who has questions should review the Q & A’s seen on Let’s Encrypt’s FAQ [2], then should questions remain after such review, they should contact Let’s Encrypt directly.   References [1] 2020.02.29 CAA Rechecking Bug https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591 [2] Revoking certain certificates on March 4 https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864 [3] Download affected certificate serials for 2020.02.29 CAA Rechecking Incidenthttps://letsencrypt.org/caaproblem/ [4] File containing serial number of the affected certificates https://d4twhgtvn0ff5.cloudfront.net/caa-rechecking-incident-affected-serials.txt.gz [5] Github – Purpose Built Checker (lecaa) https://github.com/hannob/lecaa [6] Hanno Böck https://hboeck.de/  

AUSCERT Week in Review for 28th February 2020 Greetings, Just a reminder that on Monday 2 March the AUSCERT External Security Bulletins (ESB) and AUSCERT Security Bulletins (ASB) are going to be sent from bulletins@auscert.org.au. You will still receive the bulletin service as usual but the source email address will be changed to bulletins@auscert.org.au. This change is being executed to allow for easier filtering of one of our largest volumes of email correspondence. However, if you are currently automating the bulletins you receive from auscert@auscert.org.au, make sure you tweak your scripts / update your mail rules to match on Monday 2 March. Last but not least, AUSCERT as an ally for the LGBTIQ+ community would like to wish all members a safe and enjoyable Mardi Gras weekend. Apple Takes Heat Over ‘Vulnerable’ iOS Cut-and-Paste Data Date: 2020-02-24 Author: Threatpost Any cut-and-paste data temporarily stored to an iPhone or iPad’s memory can be accessed by all apps installed on the specific device – even malicious ones. That data can then reveal private information such as a user’s GPS coordinates, passwords, banking data or a spreadsheet copied into an email. Shedding light onto the potential harm of this scenario is German software engineer, Tommy Mysk. Mysk said that any app that can constantly read a device’s clipboard can easily abuse the data. One caveat to the developer’s research was that iOS can only allow apps to read clipboard data when the apps are active and in the foreground. Apple is no strangers to clipboard concerns. Three years ago a Reddit user pleaded; “Apple should fix the clipboard on iOS to make accessing it require Permission. This is a massive opening for malicious apps.” Australian Government attacked over ransomware ‘epidemic’ Date: 2020-02-25 Author: Micky The shadow assistant minister for cyber security Tim Watts has taken aim at the Federal Government over a lack of attention to the ransomware epidemic. In an opinion piece published in the Australian Financial Review, Watts cited last year’s attack on hospitals in the Gippsland Health Alliance and the South West Alliance of Rural Health, as well as the more recent attack on global transport company Toll, as warning signs the threat was increasing. As Coronavirus Spreads, So Does Covid-19 Themed Malware Date: 2020-02-27 Author: Bleeping Computer Threat actors are still taking advantage of the ongoing COVID-19 global outbreak by attempting to drop Remcos RAT and malware payloads on their targets’ computers via malicious files that promise to provide Coronavirus safety measures. Yoroi researchers recently spotted a suspicious CoronaVirusSafetyMeasures_pdf.exe executable after it was submitted to their free sandbox-based file analysis service. As the Yoroi research team later discovered, the executable is an obfuscated Remcos RAT dropper that would drop a Remcos RAT executable on the compromised computer, together with a VBS file designed to run the RAT. Essentially, COVID-19 is a popular phishing bait right now. The World Health Organization (WHO) recently warned of active Coronavirus-themed phishing attacks that impersonate the organization with the end goal of delivering malware and stealing sensitive information. Massive DDoS Attack Shuts Down Iran’s Internet, Tehran Blames Washington Date: 2020-02-21 Author: CPO Magazine The head of Iran Civil Defense has accused Washington of the latest large-scale cyber-attack that targeted Iranian infrastructure. The coordinated Distributed Denial of Service attack affected two mobile operators and partially shut down Iran’s internet for hours. Corruption watchdog calls for mandatory data breach laws in Qld Date: 2020-02-26 Author: iTnews Queensland’s corruption watchdog has called for state government agencies to be subjected to a mandatory data breach notification scheme after uncovering corruption risks around confidential information. The Crime and Corruption Commission made the recommendation in its Operation Impala report into the misuse of confidential information in the state’s public sector. The inquiry found “potential corruption risks associated with confidential information” at seven government agencies, including police, health, transport, education and corrective services. The report, handed down on Friday, has recommended the mandatory data breach scheme be developed and managed by the Office of the Information Commissioner Queensland (OIC). ASB-2020.0049 – ALERT [Win][UNIX/Linux] Google Chrome: Multiple vulnerabilities There have been reports of active exploits in the wild. ASB-2020.0050 – ALERT [Win] Microsoft Edge: Multiple vulnerabilities The corresponding advisory from Microsoft as Edge is now based on Chrome. ESB-2020.0712 – [Cisco] Cisco Wi-Fi Products: Multiple vulnerabilities A concerning vulnerability affecting multiple Cisco Wi-Fi devices. Stay safe, stay patched and have a good weekend! The AUSCERT Team.

AUSCERT Week in Review for 21st February 2020 Greetings, On Monday 2 March the AUSCERT External Security Bulletins (ESB) and AUSCERT Security Bulletins (ASB) are going to be sent from bulletins@auscert.org.au. You will still receive the bulletin service as usual but the source email address will be changed to bulletins@auscert.org.au. This change is being executed to allow for easier filtering of one of our largest volumes of email correspondence. However, if you are currently automating the bulletins you receive from auscert@auscert.org.au, make sure you tweak your scripts / update your mail rules to match on Monday 2 March. Please see below for a selection of this week’s interesting news articles and security advisories. China seeks help of national tech giants to track coronavirus with QR codes Date: 2020-02-18 Author: iTnews China’s government is enlisting the help of Alibaba Group Holding Ltd and Tencent Holdings Ltd to expand colour-based systems for tracking individuals affected with the coronavirus nationwide. On Wednesday, Alipay, the payment app operated by Alibaba’s financial division Ant Financial, released a feature in collaboration with the government that assigns a coloured QR code representing the health of residents in Hangzhou. APIs are becoming a major target for credential stuffing attacks Date: 2020-02-19 Author: CSO Online New research shows that attackers use APIs to automate credential stuffing attacks. The financial sector is particularly vulnerable. South Korea sees rise in smishing with coronavirus misinformation Date: 2020-02-17 Author: ZDNet The South Korean government has warned the public of a sharp rise in smishing attempts — scam text messages — that use misinformation about the novel coronavirus outbreak. Firmware Weaknesses Can Turn Computer Subsystems Date: 2020-02-19 Author: Dark Reading Network cards, video cameras, and graphics adapters are a few of the subsystems whose lack of security could allow attackers to turn them into spy implants. Why fixing security vulnerabilities in medical devices, IoT is so hard Date: 2020-02-20 Author: Ars Technica When your family opened up that brand-new computer when you were a kid, you didn’t think of all of the third-party work that made typing in that first BASIC program possible. There once was a time when we didn’t have to worry about which companies produced all the bits of licensed software or hardware that underpinned our computing experience. But recent malware attacks and other security events have shown just how much we need to care about the supply chain behind the technology we use every day. The URGENT/11 vulnerability, the subject of a Cybersecurity and Infrastructure Security Agency advisory issued last July, is one of those events. It forces us to care because it affects multiple medical devices. And it serves as a demonstration of how the software component supply chain and availability of support can affect the ability of organizations to update devices to fix security bugs—especially in the embedded computing space. Samsung freaks out smartphone owners with mysterious ‘1’ notification Date: 2020-02-20 Author: Graham Cluley Many owners of Samsung smartphones have received an odd notification from the Find My Mobile app. Curious users who clicked on the notification message found that it simply disappeared, leaving them none the wiser. The truth, however, is this – no, it’s nothing malicious. It was just an accident, as Samsung explained on Twitter, and it’s not the first time a test message has accidentally gone to the wider public. ESB-2020.0537 – chromium-browser security update Keep those browsers updated! ESB-2020.0536 – firefox security update As above. ESB-2020.0548 – sudo security update Another sudo vulnerability. ESB-2020.0601 – USN-4289-1: Squid vulnerabilities DOS, bypass and possibly RCE in a popular web proxy product. Stay safe, stay patched and have a good weekend! The AUSCERT Team.

2019 Membership Annual Survey results We would like to take this opportunity to thank all members for their continued support and appreciate their contribution to the growth of the current cyber security practice and industry in the ANZ region. We are pleased to share some insights from the survey here and aim to drive our strategic plans and commitment for 2020/21 according to the various feedback provided by our members.  Key findings: Members gave us valuable feedback on potential new services with the top 3 being: Threat Intelligence Reports, Self Service URL Analysis and a Fixed-Scope Remote Service. Our members’ preferred method of hearing from us is via email and they would like us to introduce Slack as an additional form of communication. The majority of our members were either satisfied or very satisfied with their AUSCERT membership value and gave us an average score of 4.2/5.0

AUSCERT Week in Review for 14th February 2020 Happy Friday (and Valentine’s Day for those who celebrate)! If you’re still looking for a last-minute gift inspiration, we recommend giving your significant other the gift of security and help them set up two-factor authentication on their accounts (Credit: CERT NZ). In addition to our weekly summary below, please keep an eye out for a copy of our membership newsletter in your inbox today; some important messages on there including a copy of our survey results and some upcoming changes to how we send security bulletins. From Monday 2nd of March we will be sending bulletins from bulletins@auscert.org.au rather than auscert@auscert.org.au. Get ready to update your mail rules. Until next week. Microsoft Addresses Active Attacks, Air-Gap Danger with 99 Patches Date: 2020-02-11 Author: Threatpost Microsoft has issued one of its largest Patch Tuesday updates for the shortest month of the year, addressing 99 security vulnerabilities across a range of products. Twelve of the bugs are listed as critical – and the rest are rated as being important. Emotet Now Hacks Nearby Wi-Fi Networks to Spread Like a Worm Date: 2020-02-10 Author: Threatpost The new tactic used by Emotet allows the malware to infect nearby insecure Wi-Fi networks – and their devices – via brute force loops. Puerto Rico govt loses $2.6M in phishing scam Date: 2020-02-13 Author: AP News Puerto Rico’s government has lost more than $2.6 million after falling for an email phishing scam, according to a senior official. The finance director of the island’s Industrial Development Company, Rubén Rivera, said in a complaint filed to police Wednesday that the agency sent the money to a fraudulent account. Dangerous Domain Corp.com Goes Up for Sale Date: 2020-02-08 Author: Krebs on Security As an early domain name investor, Mike O’Connor had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O’Connor refused to auction perhaps the most sensitive domain in his stable — corp.com. It is sensitive because years of testing shows whoever wields it would have access to an unending stream of passwords, email and other proprietary data belonging to hundreds of thousands of systems at major companies around the globe. During an eight month analysis of wayward internal corporate traffic destined for corp.com in 2019, Schmidt found more than 375,000 Windows PCs were trying to send this domain information it had no business receiving — including attempts to log in to internal corporate networks and access specific file shares on those networks. ASB-2020.0043 – Windows Malicious Software Removal Tool Microsoft’s Patch Tuesday included fixes for the Windows Malicious Software Removal Tool. ASB-2020.0038 – Microsoft Patch Tuesday updates for Windows (February 2020) Microsoft’s Patch Tuesday also included fixes for 81 Windows vulnerabilities. ESB-2020.0480 – Security Updates Available for multiple Adobe products This bulletin contains 5 Adobe security advisories. Stay safe, stay patched and have a good weekend! Mal

AUSCERT Week in Review for 7th February 2020 Greetings, The AUSCERT team would like to thank all members who completed our 2019 Annual Survey. All completed non-anonymous survey respondents will receive a branded wireless charging mouse pad; and our survey results will be shared next week. And last but not least, our AUSCERT2020 Early Bird registrations and ticket sales are now in full swing so be sure to tap into your membership benefits. Please note that our membership team will be sending out member token emails in coming weeks so be sure to look out for these in your inbox. CDPwn: 5 Zero-Days in Cisco Discovery Protocol Date: 2020-02-06 Author: Armis Armis has discovered five critical, zero-day vulnerabilities in various implementations of the Cisco Discovery Protocol (CDP) that can allow remote attackers to completely take over devices without any user interaction. [See ESB-2020.0424.2, which was sent as an AUSCERT alert bulletin.] Apple proposes simple security upgrade for SMS 2FA codes Date: 2020-02-03 Author: Naked Security Apple engineers think they’ve come up with a simple way to make SMS two-factor authentication (2FA) one-time codes less susceptible to phishing attacks: agree a common text format so their use can be automated without the need for risky user interaction. The concept proposed by the company’s Safari WebKit team is that apps such as mobile browsers will automatically process SMS text codes as they are received, submitting them to the correct website. This dodges today’s hazard that phishing websites can first fool people into entering their password and username, before asking them to submit the correct 2FA code sent to their phone to the same bogus site. Update: Toll says IT systems infected by new variant of ‘Mailto’ ransomware Date: 2020-02-06 Author: CSO Online Australian logistics and delivery firm Toll has confirmed the ransomware attack that forced it to take its IT systems offline was a new variant of the Mailto ransomware. Toll Group took some key IT systems offline last Friday after detecting the cyber attack and has gradually released more information about the attacks and their impact, on Monday confirming it was a ransomware attack. The latest update confirms its systems were infected by the Mailto ransomware. Hackers are hijacking smart building access systems to launch DDoS attacks Date: 2020-02-02 Author: ZDNet Hackers are actively searching the internet and hijacking smart door/building access control systems, which they are using to launch DDoS attacks, according to firewall company SonicWall. The attacks are targeting Linear eMerge E3, a product of Nortek Security & Control. Anatomy of a rental phishing scam Date: 2020-02-04 Author: Jeffrey Ladish I was recently the (unsuccessful) target of a very well-crafted phishing scam. As part of a housing search a few weeks ago, I was trawling craigslist and zillow for rental opportunities in the SF bay area. I reached out to a beautiful looking rental place to inquire about a tour. Despite my experience as a security professional, I didn’t realize this was a scam until about the third email! Below I will account the story in excessive detail including screenshots. ESB-2020.0424.2 – Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability These are the “CDPwn” suite of vulnerabilities. ESB-2020.0421 – Cisco IOS XR Software Intermediate System-to-Intermediate System DoS Vulnerability DoS vulnerability for IS-IS routing protocol functionality in Cisco IOS XR Software. Stay safe, stay patched and have a good weekend! Mal