The REvil Decryption Key is Obtained,
Windows & Linux are Vulnerable to Privilege Escalation Attacks, and the Pegasus Project
Reveals Phone Spyware Targeting! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for July 27, 2021! This is your
weekly summary of the threats to our security, privacy and Internet freedom. We have a bunch of
ransomware and malware news to get into and I’ve been gone for two weeks, so.. Onto the news!!
Kaseya is a remote management software company who was recently under fire due to a vulnerability in
their product that allowed cybercriminals to hit 1500 organizations with ransomware.
Kaseya had a flaw in their customer service portal called the Kaseya Virtual System Administrator
that remained vulnerable to data leaks for six years, and tracked as CVE 2015-2862 - a directory
traversal vulnerability. Another security issue that allows for the vulnerability in Kaseya’s VSA
was tracked as CVE 2021 30116, assigned on April 2. The attack happened over fourth
of July weekend. That means Kaseya has known about this since April,
not including the earlier flaw, giving attackers plenty of time to exploit it
According to Kaseya, the online customer portal is deprecated, and that’s why it never was patched
for the 2015 issue, but it unfortunately stayed online. After the attack happened earlier this
month, Kaseya took the portal offline. REvil is the ransomware and group behind this attack,
demanding $70 million for a universal decryptor or smaller sums from each victim separately.
Strangely, though, REvil went silent and shut down their payment infrastructure
soon after demands and an unnamed third party sent Kaseya a universal decryptor key for the
REvil ransomware. Kaseya was recommended NOT to pay the ransom by multiple parties,
and they wouldn’t confirm or deny if they’d paid that $70 million to get the key.
Given recent discussions between Biden’s White House and the Russian government,
including Biden pressuring Putinrr to disrupt ransomware groups within Russia’s borders, it is
possible REvil was asked to disappear for a while as a gesture of goodwill from Putin, but this is
unclear. The US Government has not commented on any potential activities at this time.
Companies affected have a master key to decrypt their ransomed machines, but
they could still run the risk of REvil using any potentially stolen data to exploit them further.
Microsoft’s Windows 10 is vulnerable to a zero day tracked as CVE-2021-36934.
Dubbed SeriousSAM, this vulnerability could allow an attacker to gain admin rights and
execute arbitrary code using SYSTEM privileges on a system. This was disclosed publicly via twitter
user @jonasLyk and it has not been patched, but Microsoft is now sharing a workaround.
This issue affects client and server side versions of Windows 10 since October of 2018.
While not officially released yet, Windows 11 appears to also be impacted.
According to a Microsoft security advisory, the elevation of privilege vulnerability exists
because of overly permissive Access Control Lists on multiple system files,
including the Security Accounts Manager database (called SAM for short,
hence the nickname for the flaw). This could allow an attacker to then install programs,
view / change / or delete data, or create new accounts with full user rights. The attacker
would need to have the ability to execute code on the victim system in order to exploit the flaw.
All of the databases impacted are found under the system32\config
directory. An attacker could steal NTLM hashed passwords to escalate their user privileges
via a pass-the-hash attack. The files could be accessed using shadow volume copies,
since they wouldn’t be directly accessible as they’re always in use by the operating system.
While we wait for a patch, Microsoft’s temporary workaround is to restrict access
to the directory and delete the volume shadow copy service. The workaround can be set up via
the command prompt or powershell. Shadow copies are sometimes used to restore data,
so be aware that removing the copies could impact data restoration processes.
We’ll likely see an update from Microsoft with a patch very soon,
possibly within a few days if not already posted after the writing and recording of this segment
I also wanted to mention Sequoia, another privilege escalation issue,
but this one is found in Linux. This issue is tracked as CVE 2021-33909 and it affects
default installations of Ubuntu 20.04, 20.10, 21.04, Debian 11, and Fedora 34 Workstation,
along with Red Hat Enterprise Linux 6, 7, and 8. This could be exploited by a malicious user,
with malware that is already dropped on a vulnerable machine.
Sequoia comes from the Linux Kernel’s sequence file interface,
and a size t to int type conversion vulnerability. This could allow an attacker, locally, to edit or
delete a deep directory structure resulting in a privilege escalation. Mitigations techniques are
available via the Qualys blog, and patches will be rolling out from Linux distros.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support. And a quick shoutout to Nix, Fred C, Logan A, Rausgemoved, William D,
IMCarnochan, Razor, and CMHedrick for joining the ThreatWire alliance and as always,
for supporting the show!! Check out the Patreon Alliance for your exclusive access
to an audio only podcast version of this show. Onto the third news story.
In an article by the Washington Post, an investigation showed that more than 50,000
phone numbers for activists, journalists, business execs, and politicians were possibly targeted
by the Pegasus malware - both on iPhone and Android. This matches up with a data leak
from the Israeli based NSO Group showing their Pegasus malware being used to target activists
using all sorts of exploits, including one that’s a zero click zero day in iOS.
A group of journalists made allegations against NSO Group, calling their report
the Pegasus Project, wherein they examined the leaked data and found the firm was storing a
cache of those 50k numbers. They are allegedly selling the Pegasus malware, used as a spy tool,
to governments and other third parties who could then use it to infect dissidents.
NSO Group denied all allegations. According to WaPo, 37 smartphones were confirmed to be
targeted and successfully hacked, and all of those appeared on this list. They also
mentioned that it’s unknown who made this list or why, and it’s unknown how many total from this
list were targeted or surveilled. The alleged list doesn’t include names but reporters were
able to ID numbers as belonging to many people including 600 politicians or gov’t officials,
85 human rights activists, 189 journalists, and 65 business execs.
Targets would be hacked if they, for example, visited a site and were redirected to an auto
download of the spyware - which could occur if an attacker intercepted web traffic going to
their phone. This could be done using cell phone tower clones or devices installed on their ISP.
In response, Amazon deactivated NSO Groups AWS cloud computing accounts after Amnesty
International discovered Pegasus malware was using AWS to operate via CloudFront,
and this was confirmed by Citizen Lab researchers.
While Apple recently dropped a slew of updates in their most recent patch - version 14.7 for
iOS or iPadOS, that doesn’t include any patch for Pegasus. No additional
patches for vulnerabilities contributing to Pegasus malware are available at this time.
So, I’ve never mentioned it on ThreatWire but I also run a Sailor Moon youtube channel. Ya’ll
know I love that anime so this is a little side hobby for me. It’s called Sailor Snubs,
and if you’re into more lighthearted merch reviews and you wanna see my weeb side, check it out and
subscribe: youtube.com/sailorsnubs. And with that, don't forget to like
and subscribe to this channel as well! I'm Shannon Morse, I'll see you on the Internet!