Moldova is facing a tide of disinformation unprecedented in complexity and aggression, the head of a new center meant to combat it tells WIRED. And platforms like Facebook, TikTok, Telegram and YouTube could do more.

A TikTok video of actor Brian Baumgartner, from the American version of _The Office_, calling for the overthrow of the president of a small European country was an early sign that this would be no ordinary election.

Late last year, Baumgartner appeared among a lineup of American celebrities addressing Maia Sandu, the current, pro-European president of Moldova and proclaiming in bad Russian: “We, Hollywood stars, support the people of Moldova in their desire to overthrow you, Sandu.” These weren’t deepfakes. Instead the videos—which researchers suggested were part of a pro-Kremlin influence operation—were commissioned on Cameo, the app that lets anyone buy personalized greetings from celebrities. Neither Cameo nor Baumgartner’s representatives replied to WIRED’s request for comment.

For years, Moldova—a country similar in size to the US state of Maryland, sandwiched between the EU and Ukraine—has complained of Russian meddling. But more recently, as this former Soviet state prepares for a pivotal presidential vote and referendum on whether to join the EU, the country has become a cautionary tale about how the world’s biggest social media platforms can be exploited to create and fund a complex disinformation operation that sows discord around some of a society’s most divisive subjects.

Since war broke out in neighboring Ukraine two years ago, bots have been scouring the Moldovan internet, searching for authentic content to boost to wide audiences, such as videos of Ukrainian-refugees behaving badly. Then ordinary Moldovans complained their Facebook feeds were being inundated with political, often anti-government ads launched by pages with Vietnamese names. A year later, researchers estimated Meta had earned at least $200,000 from a pro-Kremlin ad campaign targeting Moldova alone. Russia’s foreign ministry did not reply to WIRED’s request to comment.

“It’s unprecedented in terms of complexity,” says Ana Revenco, Moldova’s former interior minister, now in charge of the country’s new Center for Strategic Communication and Combating Disinformation. What’s happening in Moldova on Facebook, Telegram, TikTok, and YouTube, she believes, carries a warning for the rest of the world. “This shows us our collective vulnerability,” she says. “Platforms are not only active here. If \[Russia\] can use them here, they can use them everywhere.”

Ahead of the vote on Sunday, accounts linked to Russia have reached new levels of aggression, Revenco says. “They activate accounts that have been created long ago and have been on standby,” she explains. “They are engaging bots, and they're synchronizing posts across multiple platforms.”

The EU referendum is a pivotal moment for Moldova. On Sunday, voters will face a yes or no choice on whether their country should enshrine its intention to eventually join the EU in its constitution and allow President Sandu to seek closer ties with the bloc, a move prompted by the war in Ukraine. A yes vote “would create the legal guarantee for the country to move towards the European Union, irrespective of governments in the future,” says Iulian Groza, executive director of the Institute for European Policies and Reforms, a nonprofit that wants to accelerate Moldova’s integration into Europe.

Polls suggest 55 percent of Moldovans support joining the EU. But more than one-third of eligible voters must turn up at the polling stations for the vote to be valid. That means pro-Kremlin forces in the country are encouraging people not to vote at all on Sunday, says Groza. “Those who campaign to boycott the vote, basically campaign for the referendum not to pass.”

Revenco believes there is evidence that Russia is behind the disorientating amount of online activity. “Police investigations throughout the last two years clearly saw the connection with the organized criminal groups, including those who are on the international sanctions list,” she says. “This investigation traces their connections indeed to Russia, including the military ecosystem, banking ecosystem, and financial, including those banks that are also on the international sanctions list.”

In October, police announced the seizure of piles of cash and mobile phones they linked to organizations associated with Ilan Shor, a fugitive Moldovan oligarch, living in exile in Russia. Police said these affiliates were preparing to organize vote-buying through Telegram—an allegation Shor called an “absurd spectacle.” On Telegram, bots have been offering up to $280 to people who post on Facebook against joining the EU. “They are outsourcing disinformation,” says Victoria Olari, research assistant at the Atlantic Council’s Digital Forensic Research Lab, who is based in Moldova’s capital, Chișinău. “They're being paid to make posts for their friends, for their close circle of people.”

Olari described the Telegram bot as an example of how brazen Russia had become in Moldova. "This is the first time Russia is not hiding anymore; they are doing this openly,” she says. Government officials claim Russia spent around €50 million ($54.3 million) on election interference last year, with the amount expected to more than double by the end of 2024, according to Revenco.

Revenco says her team has been trying to reach out to social media platforms about the problems. “Communication is much better than, let's say, one year ago.” Yet there is still room for the platforms to do much more, she says.

The narratives she sees circulating are designed to increase anti-EU sentiment, pro-Russia sentiment, but also anti-Ukrainian sentiment, she adds. “AI is used in order to multiply the messages and reach out to a greater audience in a short time.” Revenco did not provide specific examples, but a deepfake video featuring President Sandu has been circulating on Telegram, according to think tank Watchdog MD, even as the polls suggest Sandu will be reelected this weekend.

Earlier this month, Meta said it had removed Facebook and Instagram accounts centered around a dozen fictitious, Russian-language news brands. The fake accounts behind this activity posted original content, including cartoons and criticism of President Sandu, Meta said in a statement. “The operators also posted about offering money and giveaways, including food and concert tickets, if people in Moldova would follow them on social media or make graffiti with the campaign’s brand names.” Telegram, TikTok parent Bytedance, and YouTube parent Alphabet did not respond to WIRED’s questions about the steps they’d taken to limit disinformation in Moldova ahead of the vote.

Although Telegram did remove accounts linked to Shor earlier this month, at the authorities’ request, Revenco does not seem impressed by the platforms’ efforts overall. “The fact that \[disinformation\] continues to be present and very creative in terms of using various capabilities of these networks once again proves that the efforts undertaken so far are not sufficient.”

The Disinformation Warning Coming From the Edge of Europe

Microsoft researchers toyed with app permissions to uncover CVE-2024-44133, using it to access sensitive user data. Adware merchants may have as well.

Source: Delphotos via Alamy Stock Photo

A security weakness in the Safari browser on macOS devices might have exposed users to spying, data theft, and other forms of malware.

The issue is enabled by the special permissions Apple gives to its proprietary apps — in this case, its browser — and the ease with which an attacker can reach important app configuration files. In the end, it allows an attacker to bypass the Transparency, Consent, and Control (TCC) security layer that MacBooks use to guard sensitive data. Its CVE entry, CVE-2024-44133, has earned a "medium" severity 5.5 rating in the Common Vulnerability Scoring System (CVSS).

Researchers from Microsoft have named their exploit of CVE-2024-44133 "HM Surf." In a new blog post, they described how HM Surf could open the door to a user's browsing data, camera, and microphone, as well as their device's location, among other things. And the threat doesn't only appear to be theoretical: There's already inconclusive but not insignificant evidence to suggest that one adware program has already exploited CVE-2024-44133, or something quite like it, in the wild.

Apple released a fix for CVE-2024-44133 in its update to macOS Sequoia back on Sept. 16.

"It's a serious concern, because of the unauthorized access it gives," says Xen Madden, cybersecurity expert at Menlo Security, emphasizing the need for organizations to update their macOS devices. But, she adds, "By the looks of it, most EDR tools will detect it, especially since Microsoft Defender is detecting it."

**Exploiting HM Surf**

In any and all Apple devices, TCC is there to manage what sensitive data and features apps can access. If some app wants to access your camera, for example, thanks to TCC, you can rest assured that your Mac will ask for your permission first.

Unless your app has a special "entitlement." Some of Apple's proprietary apps possess entitlements — special permissions, approved by Apple, which allow them unique privileges compared to other apps. The core of why HM Surf works is Safari's entitlement, "com.apple.private.tcc.allow," which allows it to bypass TCC at an app level, and apply it only on a per website ("per origin") basis. In other words, Safari can freely access your camera and microphone as it wishes, but any given website you visit through Safari likely cannot.

Safari's configuration — including the rules that define per-origin TCC protections — are stored in various files under ~/Library/Safari, within the user's home directory. Manipulating these files could provide a path to TCC bypass, though the home directory is itself TCC protected.

Getting around that roadblock is simple, though, using the autological directory service command line utility (DSCL), a tool in macOS for managing directory services from the command line. In HM Surf, DSCL is used to temporarily change the home directory, removing the TCC umbrella shielding ~/Library/Safari. Now they could modify Safari's per-origin TCC configurations — allowing all kinds of permissions for a malicious website of their own creation — before ultimately reinstating the home directory. Thereafter, if a user visited the malicious site, the site would have full rein to capture screenshots, location data, and more, without ever triggering a permission pop-up.

**Was CVE-2024-44133 Already Exploited?**

After concocting their exploit, Microsoft started scanning customer environments for activity that aligned with what they'd found. On one device, lo and behold, they spotted something quite closely resembling what they were looking for.

It was a program digging into the victim's Chrome configuration settings, adding approval for microphone and camera access to a specific URL. It also did more: gathering user and device information, laying the groundwork for a second-stage payload.

This program, it turned out, was a well-known macOS adware program called "AdLoad." AdLoad hijacks and redirects browser traffic, pestering users with unwanted advertisements. It also goes further: harvesting user data, turning infected devices into nodes in a botnet, and acting as a staging ground for further malicious payloads.

In its blog post, Microsoft noted that though AdLoad's activity closely resembled the HM Surf technique, "Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the AdLoad campaign is exploiting the HM surf vulnerability itself." Still, it added, "Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique."

Dark Reading has contacted both Apple and Microsoft for further comment on this story.

**About the Author**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

MacOS Safari 'HM Surf' Exploit Exposes Camera, Mic, Browser Data

This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an
unauthorized attacker to trigger a gradual degradation in performance.



Skip to content

**Navigation Menu**

*   *   GitHub Copilot
        
        Write better code with AI
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Actions
        
        Automate any workflow
        
    *   Codespaces
        
        Instant dev environments
        
    *   Issues
        
        Plan and track work
        
    *   Code Review
        
        Manage code changes
        
    *   Discussions
        
        Collaborate outside of code
        
    *   Code Search
        
        Find more, search less
        
    

*   Explore
    
    *   Learning Pathways
    *   White papers, Ebooks, Webinars
    *   Customer Stories
    *   Partners
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   *   Enterprise platform
        
        AI-powered developer platform
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-45526

**Security Update for the OPC UA .NET Standard Stack**

**Package**

nuget OPCFoundation.NetStandard.Opc.Ua (NuGet)

**Affected versions**

< 1.5.374.118

**Patched versions**

1.5.374.118

nuget OPCFoundation.NetStandard.Opc.Ua.Core (NuGet)

**Description**

This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an  
unauthorized attacker to trigger a gradual degradation in performance.

**References**

*   GHSA-7vfh-cqpc-4267

Published to the GitHub Advisory Database

Oct 18, 2024

Last updated

Oct 18, 2024

GHSA-7vfh-cqpc-4267: Security Update for the OPC UA .NET Standard Stack

This security update resolves a vulnerability in the OPC UA .NET Standard Stack that enables an unauthorized attacker to trigger a rapid increase in memory consumption.

Skip to content

**Navigation Menu**

*   *   GitHub Copilot
        
        Write better code with AI
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Actions
        
        Automate any workflow
        
    *   Codespaces
        
        Instant dev environments
        
    *   Issues
        
        Plan and track work
        
    *   Code Review
        
        Manage code changes
        
    *   Discussions
        
        Collaborate outside of code
        
    *   Code Search
        
        Find more, search less
        
    

*   Explore
    
    *   Learning Pathways
    *   White papers, Ebooks, Webinars
    *   Customer Stories
    *   Partners
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   *   Enterprise platform
        
        AI-powered developer platform
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  GHSA-qm9f-c3v9-wphv

**Security Update for the OPC UA .NET Standard Stack**

**Package**

nuget OPCFoundation.NetStandard.Opc.Ua (NuGet)

**Affected versions**

< 1.05.374.54

**Patched versions**

1.05.374.54

nuget OPCFoundation.NetStandard.Opc.Ua.Core (NuGet)

**Description**

This security update resolves a vulnerability in the OPC UA .NET Standard Stack that enables an unauthorized attacker to trigger a rapid increase in memory consumption.

**References**

*   GHSA-qm9f-c3v9-wphv

Published to the GitHub Advisory Database

Oct 18, 2024

Last updated

Oct 18, 2024

GHSA-qm9f-c3v9-wphv: Security Update for the OPC UA .NET Standard Stack

Adoption of the email authentication and policy specification remains low, and only about a tenth of DMARC-enabled domains enforce policies. Everyone is waiting for major email providers to get strict.

Source: TierneyMJ via Shutterstock

The state of DMARC email authentication and security standard looked so promising at the beginning of 2024.

Google and Yahoo had set a deadline of February 2024 for bulk email senders to adopt a Domain-based Message Authentication, Reporting and Conformance (DMARC) policy, and as companies scrambled to meet the deadline, the number of email domains with a valid DMARC record jumped 60% in two months. As of September, nearly 6.8 million domains have email sender authentication configured.

Even with that surge earlier in the year, the reality is that businesses continue to be slow in setting up email authentication on their domains. The adoption lag is especially pronounced in making the switch from DMARC's minimum-baseline policy of 'p=none' to more stringent policies. Enforcement means non-authenticated emails get quarantined or rejected. The share of DMARC-enabled domains with an enforced policy has actually gone down from a high of 18% a year ago, to less than 14% today.

While Google's and Yahoo's actions forced many companies to adopt DMARC, most of them — spurred by concerns about blocking legitimate messages — haven't adopted the quarantine or reject policies, says Seth Blank, chief technology officer at Valimail, a provider of email security services.

"Google and Yahoo put the requirements out, the ecosystem got a shot in the arm, and the message was heavily about security — so the people who cared about security did something," Blank says. "There's still a large part of this market that has not moved, hasn't taken any steps, even this bare minimum that we're seeing here."

The DMARC protocol aims to add authentication to the Internet's email infrastructure, requiring that email senders adopt two verification technologies — Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) — and specify a policy for how other servers should handle mail from a sender not part of an authorized domain. In October 2023, Google and Yahoo required that email marketers — anyone sending more than 5,000 emails daily through the services — set up DMARC. The move resulted in a significant reduction in non-authenticated emails, with Google seeing two-thirds less (65%) unauthenticated messages sent to Gmail users and 265 billion fewer unauthenticated message sent so far this year, according to company data released last week.

**Fear, Uncertainty, and DMARC**

The adoption rate of DMARC has roughly doubled over the past year — from about 55,000 domains adding new DMARC records each month in 2023, to 110,000 domains per month in Q3 2024, according to Valimail data. Yet, even at that rate, it would still take nearly 15 more years for the top 25 million domains to get on board.

Source: Author, with data from Valimail

Moreover, DMARC adoption has been spotty. While more than 60% of the organizations in some industries, such as manufacturing and healthcare, have adopted DMARC, only one in five have actually moved from the lowest security policy ('p=none') to the highest ('p=reject,') according to data from EasyDMARC, an email-authentication services firm. Some sectors, such as non-profits and charity organizations, have increased adoption over the year, but fewer than 8% of domains are using DMARC.

Because email is critical to business operations, organizations worry that stricter enforcement will result in lost messages, especially because DMARC is not necessary an easy technology to implement and maintain, says Kelly Molloy, director of network development for DomainTools, an internet intelligence firm.

"The fear is, especially if you are a company who depends on leads via email, is that you're going to miss messages from interested parties — from customers and potential customers — if you start doing \[strict enforcement\]," she says, adding: "A lot of companies are being conservative and are not going farther than they really need to ... because it does take resources."

**Waiting for the Other Shoe to Drop**

The stalled adoption cycle will likely attract another major move by Google, Yahoo and other large consumer email services, says Hagop Khatchoian, technical services team lead at EasyDMARC.

"They \[Google and Yahoo\] are just forcing everyone to have at least 'p=none' ... to just have a basic policy without any enforcement — we foresee that will be changed in the next few years," he says. "But you can't just go on and tell everyone, 'Hey, you need 'p=reject,' ... because if you have a small misconfiguration in your email ecosystem, and you have an enforced policy, then your own legitimate emails will be blocked as well."

Valimail's Blank agrees, noting that the major email services — Google, Microsoft and Yahoo, as well as major email providers in other countries — are unlikely to wait long before again turning the screws on unauthenticated email.

"The sending community or the receiving community will mandate the next steps, because they know \[authentication\] is the single most important input into their system — being able to know who sent an email with far more certainty," he says. "We're going to see more action there ... and it will take years, but it's not going to be five to ten years. It's probably two, three, maybe four."

**None's Not Nothing, But Close to It**

With another DMARC-push in the cards from major email services, organizations should plan to shift their DMARC policy from 'none' to a higher level of enforcement.

The three levels of enforcement are:

*   p=none — Mail that fails authentication checks are still delivered.
    
*   p=quarantine — Any authentication failure results in email being quarantined, possibly delivered to a user's spam folder or to an organization's quarantine storage.
    
*   p=reject — Authentication failure leads to the email being discarded, although some service providers may instead quarantine the email in a separate folder.
    

Every enforcement level can produce reports, and companies should monitor the reports to check for issues and anomalies, says Valimail's Blank.

"DMARC at 'p=none' with no reporting is syntactically equivalent to not having DMARC at all," he says. "The value of DMARC comes from reporting and working towards a policy that is not 'none.' If you have 'p=none', and you're not getting reports, there is nothing you can do, there is nothing you can see, there is nothing you can fix."

Getting reports from the DMARC infrastructure is important level of visibility for companies as they pursue better email security. Large companies are not the only organizations to see significant abuse of email, so any firms that sends email should monitor their DMARC reports, he says.

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Time to Get Strict With DMARC

The security firm is denying an assessment that its systems were compromised in Israel by pro-Palestinian cyberattackers, but acknowledged an attack on one of its partners.

Source: David R. Frazier Photolibrary via Alamy Stock Photo

Security firm ESET is refuting reports that cyberattackers compromised its platforms and used them to target customers in Israel with dangerous wiper malware. However, it did note that a partner there, Comsecure, was impacted.

"We are aware of a security incident which affected our partner company in Israel last week," the firm acknowledged on social media platform X. "Based on our initial investigation, a limited malicious email campaign was blocked within ten minutes. ESET technology is blocking the threat and our customers are secure. ESET was not compromised and is working closely with its partner to further investigate and we continue to monitor the situation."

Security researcher Kevin Beaumont (aka Gossi the Dog) prompted the response after blogging about a malicious email that an ESET user posted on the ESET user forum. The email was flagged as malicious, with the subject line, "Government-Backed Attackers May Be Trying to Compromise Your Device!" It purported to be from the ESET team, offering extra security defense in the face of an ongoing attack:

Source: ESET user forum.

The email had a .ZIP attachment that, if opened, unpacked a destructive wiper malware that bears resemblance to that used by the Handala threat group, according to the person who flagged the email for Beaumont. Handala, so named for the political cartoon character that has come to personify the Palestinian people’s national identity, is known for targeting Israeli organizations with file-destroying wipers in the wake of the Oct. 7 Hamas attacks and resulting war.

Related:Dark Reading Confidential: Meet the Ransomware Negotiators

Beaumont noted, "I managed to obtain the email, which passes both DKIM and SPF checks for coming from ESET’s store," he said in the blog post. "Additionally, the link is indeed to backend.store.eset.co.il — owned by ESET Israel."

This led Beaumont to conclude via Mastodon, "ESET Israel definitely got compromised, this thing is fake ransomware that talks to an Israeli news org server for whatever reason."

ESET has now categorically refuted that takeaway, so the assumption is that the cyberattackers were using some sort of MO to get around anti-spoofing measures for the email and the .ZIP link. ESET did not immediately return a request for comment from Dark Reading for more information on Comsecure's role in the incident and the attack routine.

The campaign is now blocked for ESET customers.

**About the Author**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

ESET-Branded Wiper Attack Targets Israel; Firm Denies Compromise

A survey shows three-quarters of CISOs are drowning in threat detections put out by a sprawling stack of tools, yet still lack the basic visibility necessary to identify breaches.

Source: Kjetil Kolbjørnsrud via Alamy Stock Photo

Global information security spend is projected to reach $215 billion by the end of 2024. But a new survey of chief information security officers (CISOs) shows that all that cash might not have bought the peace of mind they hoped for. In fact, 44% of CISOs across the globe reported missing a data breach in the past 12 months with existing tools.

The top blind spot identified in the survey of 234 global CISOs was hybrid cloud infrastructure and data-in-transit, which eight out of 10 of those surveyed by Gigamon said is a "top concern." Gigamon's report added that data-in-motion is where 93% of malware has historically hidden. Overwhelmingly, 84% of surveyed CISOs said getting visibility into this encrypted traffic was a top priority for the upcoming year.

"Modern cybersecurity is about differentiating between acceptable and unacceptable risk," Chaim Mazal, CSO at Gigamon, said in the survey report. "Our research shows where CISOs are drawing that line, highlighting the critical importance of visibility into all data-in-motion to secure complex hybrid cloud infrastructure against today’s emerging threats. It’s clear current approaches aren’t keeping pace, which is why CISOs must reevaluate tool stacks and reprioritize investments and resources to more confidently secure their infrastructure."

Related:Fighting Crime With Technology: Safety First

**The Cloud and Cyber Threat Observability**

Deep observability into hybrid cloud environments is top of mind for 82% of surveyed CISOs. And 85% of those surveyed would like to gain visibility into packet-level and application metadata. Boards too agree that this deep observability is critical, with 81% of CISOs reporting hybrid cloud infrastructure will be a budgeting priority in 2025.

"Today’s CISOs recognize that security and observability are intrinsically connected," Stephen Elliott, group vice president, IT operations, observability, and CloudOps at IDC, said in the report. "The network provides a crucial layer of context that can inform security operations and vice versa, which is why modern security teams are leveraging network-derived intelligence and insights to understand the true impact of a threat and prioritize their responses accordingly."

But before CISOs start spending on new tools, they plan to get the most out of what they already have, according to the survey. Three-quarters of those CISOs surveyed reported being "overwhelmed" by the growing number of tools and their alerts. So to get a better handle on hybrid cloud data and infrastructure, for instance, 60% of CISOs said their top priority for 2025 will be to consolidate and optimize existing tools for that arena.

Related:Cloud, AI Talent Gaps Plague Cybersecurity Teams

CISOs: Throwing Cash at Tools Isn't Helping Detect Breaches

### Impact
The CVE is for a software vulnerability. Network admins who have deployed tacquito (or versions of tacquito) in their production environments and use tacquito to perform command authorization for network devices should be impacted.

Tacquito code prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was performing regex matches on authorized commands and arguments in a more permissive than intended manner. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. This behaviour could potentially allowed unauthorized commands to be executed.

### Patches
The problem has been patched, and users should update to the latest github repo commit to get the patch. 

### Workarounds
Users should be able to add boundary conditions anchors '^' and '$' to their command configs to remediate the vulnerability without the upgrade


**Impact**

The CVE is for a software vulnerability. Network admins who have deployed tacquito (or versions of tacquito) in their production environments and use tacquito to perform command authorization for network devices should be impacted.

Tacquito code prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was performing regex matches on authorized commands and arguments in a more permissive than intended manner. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. This behaviour could potentially allowed unauthorized commands to be executed.

**Patches**

The problem has been patched, and users should update to the latest github repo commit to get the patch.

**Workarounds**

Users should be able to add boundary conditions anchors '^' and '$' to their command configs to remediate the vulnerability without the upgrade

**References**

*   GHSA-p5wf-cmr4-xrwr
*   facebookincubator/tacquito@07b49d1

GHSA-p5wf-cmr4-xrwr: Permissive Regular Expression in tacquito

Microsoft disclosed details about the HM Surf vulnerability that  could allow an attacker to gain access to the user’s data in Safari

The Microsoft Threat Intelligence team disclosed details about a macOS vulnerability, dubbed “HM Surf,” that could allow an attacker to gain access to the user’s data in Safari. The data the attacker could access without users’ consent includes browsed pages, along with the device’s camera, microphone, and location.

The vulnerability, tracked as CVE-2024-44133 was fixed in the September 16 update for Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later).

It is important to note that this vulnerability would only impact Mobile Device Management (MDM) managed devices. MDM managed devices are typically subject to centralized management and security policies set by the organization’s IT department.

Microsoft has dubbed the flaw “HM Surf.” By exploiting this vulnerability an attacker could bypass the macOS Transparency, Consent, and Control (TCC) technology and gain unauthorized access to a user’s protected data.

Users may notice Safari’s TCC in action when they browse a website that requires access to the camera or the microphone. They may see a prompt like this one:

Image courtesy of Microsoft

What Microsoft discovered was that Safari maintains its own separate TCC policy which it maintains in various local files.

At that point Microsoft figured out it was possible to modify the sensitive files, by swapping the home directory of the current user back and forth. The home directory is protected by the TCC, but by changing the home directory, then change the file, and then making it the home directory again, Safari will use the modified files.

The exploit only works on Safari because third-party browsers such as Google Chrome, Mozilla Firefox, or Microsoft Edge do not have the same private entitlements as Apple applications. Therefore, those apps can’t bypass the macOS TCC checks.

Microsoft noted that it observed suspicious activity in the wild associated with the Adload adware that might be exploiting this vulnerability. But it could not be entirely sure whether the exact same exploit was used.

> “Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the Adload campaign is exploiting the HM surf vulnerability itself. Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique.”

We encourage macOS users to apply these security updates as soon as possible if they haven’t already.

Malwarebytes for Mac takes out malware, adware, spyware, and other threats before they can infect your machine and ruin your day. It’ll keep you safe online and your Mac running like it should.

 Unauthorized data access vulnerability in macOS is detailed by Microsoft 

This year, the majority of developers have adopted AI assistants to help with coding and improve code output, but most are also creating more vulnerabilities that take longer to remediate.

Source: Gorodenkoff via Shutterstock

Less than two years after the general release of ChatGPT, most software developers have adopted AI assistants for programming. That's boosting efficiency, but at the same time, it's led to a higher cadence of software development that has made maintaining security more difficult.

Developers are on track to download more than 6.6 trillion software components in 2024, which includes a 70% increase in downloads of JavaScript components and a 87% increase in Python modules, according to the annual "State of the Software Supply Chain" report from Sonatype. At the same time, the mean time to remediate vulnerabilities in those open source projects has grown significantly over the past seven years, from about 25 days in 2017 to more than 300 days in 2024.

One likely reason: The advent of AI is driving speedier development cycles, making security more difficult, says Brian Fox, chief technology officer of Sonatype. The majority of developers now use AI tools in their development process according to a recent Stackoverflow survey, with 62% of coders saying they used an AI assistant, up from 44% last year.

"AI has quickly become a powerful tool for speeding up the coding process, but the pace of security has not progressed as quickly, and it’s creating a gap that is leading to lower-quality, less-secure code," he says. "We’re headed in the right direction, but the true benefit of AI will come when developers don’t have to sacrifice quality or security for speed."

Related:News Desk 2024: Hacking Microsoft Copilot Is Scary Easy

Security researchers have warned that AI code generation could result in more vulnerabilities and novel attacks. For instance, a group of researchers demonstrated the ability to poison the large language models (LLMs) used for code generation with maliciously exploitable code at the USENIX Security Symposium in August. In March, researchers with an LLM security vendor showed that attackers could use AI hallucinations as a way to direct developers and their applications to malicious packages.

Developers also have growing concerns over the potential for AI assistants to suggest or propagate vulnerable code. While the majority of developers (56%) expect AI assistants to provide usable code, only 23% expect the code to be secure, while a larger group (40%) don't believe AI assistants provide secure code at all, according to research by software development firm JetBrains and the University of California at Irvine, published in June.

Open source projects take longer to remediate vulnerabilities. Source: Sonatype

Many developers remain nonplussed by the speed of change wrought by AI coding tools, and there is likely more to come, says Jimmy Rabon, senior product manager with Black Duck Software, a software-integrity tools provider.

Related:Chinese Researchers Tap Quantum to Break Encryption

"We haven't seen the long-term effects of adding something that can code at the level of a junior- or intermediate-level developer and at massive scale," he says. "My expectation is that we will see more intermediate mistakes — the basic mistakes that you would make as a junior or intermediate level developer — and \[issues with\] understanding the context of where some of the data flows."

**2024: The Year of the Developer's AI Assistant**

While AI assistants are now being used by the majority of developers, in business environments, adoption of AI tools is much higher — more than 90% of developers used AI assistants, according to Black Duck's 2024 Global State of DevSecOps survey. AI as a tool for developers is well-entrenched and "will never go away," Rabon says.

Yet many developers don't have the experience to judge whether code provided by an AI assistant is safe. Entry-level developers, for example, are more trusting of AI-produced code than their professional counterparts, with 49% trusting the accuracy of AI-generated code versus 42% for more experienced developers, according to Stackoverflow's annual developer survey.

Related:WP Engine Accuses WordPress of 'Forcibly' Taking Over Its Plug-in

In addition, AI tools will affect the education of developers and could make it harder for those entry-level developers to gain the skill needed to advance in their careers, experts say. The reliance on AI to complete simple programming projects could reduce the need for new or entry-level developers who typically tackle simpler coding tasks, removing a training path, Sonatype's Fox says.

"The development community is aging, and the introduction of AI poses potential risks to younger generations," he says. "If AI can handle the tasks previously assigned to budding developers, how will they gain the experience needed to replace older developers exiting the industry?"

**Automatic Generation of Secure Code**

Until the companies behind AI assistants create training datasets that contain secure code suggestions, or put in place guardrails to protect against vulnerable and malicious code generation, companies will have to deploy automated software security tools to check the work of any coding assistant.

The good news is, between the additional security checks and the fast evolution of code-generation assistants, the security of software and applications could eventually become much stronger, says Black Duck's Rabon.

"There are certain basic security flaws that I think will disappear," he says. "If you asked an AI system to generate code, why should it ever \[suggest an insecure function?\] ... I don't think that we've had enough time to really see the dramatic effects of \[such capabilities\] or prove them out."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Latest News