Black Arrow Cyber Advisory 09/11/2022 – VMware provides patches for five vulnerabilities in Workspace ONE.

Executive Summary

VMware Workspace ONE Assist is a remote control support application provided by VMware, who announced on 08/11/2022 that five vulnerabilities including three rated as critical in severity are present within version v21.X and v22.X versions of the software, which are fixed in version 22.10. The vulnerabilities could allow for a malicious actor to obtain administrative access without the need to authenticate to an endpoint with the software installed, either over the internet or on the network.

What’s the risk to me or my business?

If the remote support tool is installed on business endpoints running version 22.09 or below, then they are vulnerable to exploitation, which could lead to further compromise of confidentiality, integrity and availability of organisational information.

What can I do?

VMware has released a new version of VMware Workspace ONE which patches all of the mentioned vulnerabilities. Discuss with you Managed Service Provider (MSP) whether any of your devices or services are impacted, and when they can expect to be patched.

---

Technical Summary

The following is a break down of the different vulnerabilities which affect VMware Workspace ONE.

CVE-2022-31685: An authentication bypass vulnerability for VMware Workspace ONE with a maximum CVSS 3 base score of 9.8, which allows a malicious actor with network access to Workspace ONE Assist to obtain administrative access without the need to authenticate to the application.

CVE-2022-31686: A broken authentication method vulnerability for VMware Workspace ONE with a maximum CVSS 3 base score of 9.8, which allows a malicious actor with network access to obtain administrative access without the need to authenticate to the application.

CVE-2022-31687: A broken access control vulnerability for VMware Workspace ONE with a maximum CVSS 3 base score of 9.8, which allows a malicious actor with network access to obtain administrative access without the need to authenticate to the application.

CVE-2022-31688: A cross-site scripting (XSS) vulnerability for VMware Workspace ONE with a maximum CVSS 3 base score of 6.4, which allows a malicious actor to inject JavaScript code into the target users window with some user interaction due to improper user input sanitation.

CVE-2022-31689: A session fixation vulnerability for VMware Workspace ONE with a maximum CVSS 3 base score of 4.2, which allows a malicious actor to authenticate to the application if they manage to obtain a valid session token.

Further technical information on the vulnerabilities can be found here: https://www.vmware.com/security/advisories/VMSA-2022-0028.html, with the new version of Workspace ONE available here: https://kb.vmware.com/s/article/89993

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 15 April 2022

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• Cyber Security Is Getting Harder: More Threats, More Complexity, Fewer People

Splunk and Enterprise Strategy Group released a global research report that examines the security issues facing the modern enterprise. More than 1,200 security leaders participated in the survey, revealing they’ve seen an increase in cyber attacks while their teams are facing widening talent gaps.

According to the report, 65% of respondents say they have seen an increase in attempted cyber attacks. In addition, many have been directly impacted by data breaches and costly ransomware attacks, which have left security teams exhausted:

·       49% of organisations say they have suffered a data breach over the past two years, an increase from 39% a year earlier.

·       79% of respondents say they’ve encountered ransomware attacks, and 35% admit that one or more of those attacks led them to lose access to data and systems.

·       59% of security teams say they had to devote significant time and resources to remediation, an increase from 42% a year ago.

·       54% of respondents report that their business-critical applications have suffered from unplanned outages related to cyber security incidents on at least a monthly basis, with a median of 12 outages per year. The median time to recover from unplanned downtime tied to cyber security incidents is 14 hours. Respondents estimated the cost of this downtime averaged about $200,000 per hour.

·       64% of security professionals have stated that it’s challenging to keep up with new security requirements, up from 49% a year ago.

https://www.helpnetsecurity.com/2022/04/13/modern-enterprise-security-issues/

• Terrible Cloud Security Is Leaving the Door Open for Hackers. Here's What You're Doing Wrong

A rise in hybrid work and a shift to cloud platforms has changed how businesses operate - but it's also leaving them vulnerable to cyber attacks.

Cloud applications and services are a prime target for hackers because poor cyber security management and misconfigured services are leaving them exposed to the internet and vulnerable to simple cyber attacks.

Analysis of identity and access management (IAM) polices taking into account hundreds of thousands of users in 18,000 cloud environments across 200 organisations by cyber security researchers at Palo Alto Networks found that cloud accounts and services are leaving open doors for cyber criminals to exploit – and putting businesses and users at risk.

The global pandemic pushed organisations and employees towards new ways of remote and hybrid working, with the aid of cloud services and applications. While beneficial to businesses and employees, it also created additional cyber security risks – and malicious hackers know this.

https://www.zdnet.com/article/terrible-cloud-security-is-leaving-the-door-open-for-hackers-heres-what-youre-doing-wrong/

• More Organisations Are Paying the Ransom. Why?

Most organisations (71%) have been hit by ransomware in 2021, and most of those (63%) opted for paying the requested ransom, the 2022 Cyberthreat Defense Report (CDR) by the CyberEdge Group has shown.

The research company says that possible explanations for the steady yearly rise of the percentage of organisations that decided to pay the ransom may include: the threat of exposing exfiltrated data, increased confidence for data recovery, and the fact that many organisations find that paying a ransom is significantly less costly than system downtime, customer disruption, and potential lawsuits.

“72% of ransom-paying victims recovered their data [in 2021], up from 49% in 2017. This increased confidence for successful data recovery is often factored into the ransom-paying decision,” the company noted.

Similarly, BakerHostatler’s 2022 Data Security Incident Response Report says that in ransomware incidents the US-based law firm was called in to manage in 2021, ransomware groups provided decryptors and stuck to their promise to not publish stolen data 97% of the time.

https://www.helpnetsecurity.com/2022/04/11/organizations-paying-ransom/

• Cyber Attack Puts City Firms on High Alert to Bolster Defences

Experts warn a combination of 'ignorance and arrogance' makes City executives vulnerable to attacks.

City firms on high alert for cyber attacks were sent a clear warning recently, bolstering concerns of the potential for breaches from Russia.

Ince Group, the London-listed law firm, last month fell prey to hackers who infiltrated its computer systems and stole confidential data. The company's security systems detected the intrusion on March 13, prompting the IT team to shut down servers to try and prevent widespread damage.

But soon after, the hackers demanded a ransom for stolen data and threatened to publish it on the dark web if Ince Group, which has clients in the shipping, energy and healthcare sectors, didn't pay up.

The incident has intensified worries of possible breaches after warnings that City firms could be targeted by Russian hackers following Putin’s invasion of Ukraine.

Julia O'Toole, chief executive of MyCena Security Solutions, says executives should be "very concerned" about any news of a cyber attack at a rival company.

https://www.telegraph.co.uk/business/2022/04/11/cyber-attack-puts-city-firms-high-alert-bolster-defences/

• More Than 60% of Organisations Suffered a Breach in the Past 12 Months

Firms focus too narrowly on external attackers when it's insiders, third parties, and stolen assets that cause many breaches, new study shows.

The majority of companies — 63% — have suffered at least one breach in the past 12 months. The global average breach cost $2.4 million — a price tag that increases to $3.0 million for companies unprepared to respond to compromises.

The new data from Forrester Research, released on April 8 in a report titled "The 2021 State Of Enterprise Breaches," found that the number of breaches and the cost of breaches varied widely depending on the geographic location of the business and to what degree the organisation is prepared to respond to breaches. Companies in North America had the largest disparity between the haves and have-nots: While the average organisation required 38 days to find, eradicate, and recover from a breach, companies that failed to adequately prepare for security challenges took 62 days.

The difference in response resulted in a large difference in cost as well, with the average North American company paying $3.0 million to recover from a breach, a bill that rises to $4.0 million if the company suffered from a lack of incident-response preparation.

"The misalignment between the expectation and the reality of breaches has become very important," says Allie Mellen, an analyst with Forrester's Security and Risk group. "On a global scale, there is a big disparity of about $600,000 between those who are prepared to respond to a breach and those who are not."

https://www.darkreading.com/attacks-breaches/more-than-60-of-organizations-suffered-a-breach-in-the-past-12-months

• Account Takeover Poised to Surpass Malware as The No. 1 Security Concern

As most researchers and financial executives can attest, virtually all types of fraud have dramatically risen over the past two years. However, attackers taking over legitimate financial accounts have become even more of a favourite with cyber criminals than most fraud schemes.

Many major recent research reports have pointed out that account takeover (ATO), a form of identity theft where bad actors access legitimate bank accounts, change the account information and passwords, and hijack a real customer’s account, has skyrocketed since last year. According to Javelin Research’s annual "Identity Fraud Study: The Virtual Battleground" report, account takeover increased by 90% to an estimated $11.4 billion in 2021 when compared with 2020 — representing roughly one-quarter of all identity fraud losses last year.

Like many types of financial fraud, cyber thieves are betting on the fact that if they attempt to seize a large number of legitimate accounts, eventually they will get a payoff.

Account takeovers are a numbers game, the more accounts that an organisation has, the bigger their risk that some of them will be compromised.

Account takeovers often piggyback off of previous attacks, making these crimes a way for hackers to make the most out of stolen information. Diskin pointed out that account takeovers most commonly happen when a password is “taken from another data leak and reused for different accounts. But there are a variety of risky scenarios that can lead to compromise.”

https://www.scmagazine.com/analysis/cybercrime/account-takeover-poised-to-surpass-malware-as-the-no-1-security-concern

• Security Research Reveals 42% Rise in New Ransomware Programs In 2021

Critical infrastructure in the crosshairs: operational technology vulnerabilities jump 88% .

Threat intelligence analysts at Skybox Research Lab uncovered a 42% increase in new ransomware programs targeting known vulnerabilities in 2021. The Silicon Valley cyber security company released its annual 2022 Vulnerability and Threat Trends Report, revealing how quickly cyber criminals capitalise on new security weaknesses – shrinking the window that organisations have to remediate vulnerabilities ahead of an attack.

With 20,175 new vulnerabilities published in 2021, Skybox Research Lab witnessed the most vulnerabilities ever reported in a single year. And these new vulnerabilities are just the tip of the iceberg. The total number of vulnerabilities published over the last 10 years reached 166,938 in 2021 — a three-fold increase over a decade. These cumulative vulnerabilities, piling up year after year, represent an enormous aggregate risk, and they’ve left organisations struggling with a mountain of cyber security debt. As the US Cybersecurity and Infrastructure Security Agency (CISA) highlights in its Top Routinely Exploited Vulnerabilities list, threat actors are routinely exploiting publicly disclosed vulnerabilities from years past.

The sheer volume of accumulated risks — hundreds of thousands or even millions of vulnerability instances within organisations — means they can’t possibly patch all of them. To prevent cyber security incidents, it is critical to prioritise exposed vulnerabilities that could cause the most significant disruption, then, apply appropriate remediation options including configuration changes or network segmentation to eliminate risk, even before patches are applied or in cases where patches aren’t available.

https://informationsecuritybuzz.com/study-research/skybox-security-research-reveals-42-rise-in-new-ransomware-programs-in-2021/

• Fraudsters Stole £58m with Remote Access Trojans (RATs) in 2021

2021 saw victims of Remote Access Tool (RAT) scams lose £58m in 2021, official UK police figures show.

RAT scams involve scammers taking control of a victim’s device, typically in order to access bank accounts.

Some 20,144 victims fell for this type of scam in 2021, averaging around £2800 stolen per incident.

Typically, RAT attacks begin with a victim being inundated with pop-ups claiming there is a problem with the computer. Users are often then asked to call a “hotline” number, when a scammer will persuade them to download a RAT.

RAT scams are often compared to the classic “tech support” scams. Modern RAT scams are typically more devious, however, with scammers often cold-calling their victims pretending to work for their bank and claiming that they need computer access to investigate a fraudulent transaction.

https://www.itsecurityguru.org/2022/04/11/fraudsters-stole-58m-with-rats-in-2021/

• As State-Backed Cyber Threats Grow, Here's How the World Is Reacting

With the ongoing conflict in Eurasia, cyber warfare is inevitably making its presence felt. The fight is not only being fought on the fields. There is also a big battle happening in cyberspace. Several cyber-attacks have been reported over the past months.

Notably, cyber attacks backed by state actors are becoming prominent. There have been reports of a rise of ransomware and other malware attacks such as Cyclops Blink, HermeticWiper, and BlackCat. These target businesses as well as government institutions and nonprofit organisations. There have been cases of several attempts to shut down online communications and IT infrastructure.

The ongoing list of significant cyber incidents curated by the Center for Strategic and International Studies (CSIS) shows that the number of major incidents in January 2022 is 100% higher compared to the same period in the previous year. With the recent activities in cyberspace impacted by the emergence of the geopolitical tumult in February, it is not going to be surprising to see an even more dramatic rise in the number of significant incidents.

https://thehackernews.com/2022/04/as-state-backed-cyber-threats-grow.html

• Q1 Reported Data Compromises Up 14% Over 2021

The Identity Theft Resource Center published a First Quarter 2022 Data Breach Analysis which found that Q1 of 2022 began with the highest number of publicly reported data compromises in the past three years.

Publicly reported data compromises totalled 404 through March 31, 2022, a 14 percent increase compared to Q1 2021.

This is the third consecutive year when the number of total data compromises increased compared to Q1 of the previous year. It also represents the highest number of Q1 data compromises since 2020.

https://informationsecuritybuzz.com/expert-comments/q1-reported-data-compromises-up-14-over-2021/

• Europol Announces Operation to Hit Russian Sanctions-Evaders

European police have announced a major new operation designed to crack down on Russian oligarchs and businesses looking to circumvent sanctions.

Operation Oscar will run for at least a year as an umbrella initiative that will feature many separate investigations, Europol explained.

The policing organisation’s European Financial and Economic Crime Centre will work to exchange information and intelligence with partners and provide operational support in financial crime investigations.

A key focus appears to be on illicit flows of money, which Russian individuals and entities will be trying to move around the region in order to bypass sanctions imposed since President Putin’s invasion of Ukraine.

“Europol will centralise and analyse all information contributed under this operation to identify international links, criminal groups and suspects, as well as new criminal trends and patterns,” Europol said.

“Europol will further provide tailor-made analytical support to investigations, as well as operational coordination, forensics and technical expertise, and financial support to the relevant national authorities.”

https://www.infosecurity-magazine.com/news/europol-hit-russian/

---

Threats

Ransomware

• Ransomware: These Two Gangs Are Behind Half of All Attacks | ZDNet

• Clueless Hackers Spent Months Inside a Network And Nobody Noticed. But Then a Ransomware Gang Turned Up | ZDNet

• Conti Ransomware Leak Shows Group Operates Like a Normal Tech Company, with an HR Department, Performance Reviews and an ‘Employee of the Month’ (cnbc.com)

• Don't Let Ransomware Gangs Spend Months in Your Network • The Register

• Dismantling ZLoader: How Malicious Ads Led to Disabled Security Tools And Ransomware - Microsoft Security Blog

• Analysis of the SunnyDay Ransomware - Security Affairs

• Karakurt Data Thieves Linked to Larger Conti Hacking Group | CSO Online

• Conti Ransomware Gang Claims Responsibility for The Nordex Hack - Security Affairs

• OldGremlin Ransomware Gang Targets Russia with New Malware (bleepingcomputer.com)

• Conti Ransomware Offshoot Targets Russian Organisations | Malwarebytes Labs

Other Social Engineering

• FBI: Payment App Users Targeted in Social Engineering Attacks (bleepingcomputer.com)

• These Hackers Pretend to Poach, Recruit Rival Bank Staff In New Cyber Attacks | ZDNet

Malware

• Credential-Stealing Malware Disguises Itself As Telegram, Targets Social Media Users | Malwarebytes Labs

• Microsoft Sounds The Alarm Over New Cunning Windows Malware | TechRadar

• Spring4Shell Under Active Exploit by Mirai Botnet Herders • The Register

• Haskers Gang Gives Away ZingoStealer Malware to Other Cyber Criminals for Free (thehackernews.com)

• Hackers Hijack Adult Websites to Infect Victims With Malware | TechRadar

• Qbot Malware Switches To New Windows Installer Infection Vector (bleepingcomputer.com)

• Windows 11 tool to Add Google Play Secretly Installed Malware (bleepingcomputer.com)

• Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service (thehackernews.com)

• Researchers Warn of FFDroider and Lightning Info-Stealers Targeting Users in The Wild (thehackernews.com)

• Enemybot: a New Mirai, Gafgyt Hybrid Botnet Joins The Scene | ZDNet

Mobile

• Android Banking Malware Intercepts Calls to Customer Support (bleepingcomputer.com)

• How to Stop Octo Malware From Remotely Accessing Your Android (lifehacker.com)

IoT

• New EnemyBot DDoS Botnet Recruits Routers and IoTs Into Its Army (bleepingcomputer.com)

• 3 Reasons Connected Devices are More Vulnerable than Ever (bleepingcomputer.com)

Data Breaches/Leaks

• GitHub Says Hackers Breached Dozens of Organisations Using Stolen OAuth Access Tokens (thehackernews.com)

Organised Crime & Criminal Actors

• New Industrial Spy Stolen Data Market Promoted Through Cracks, Adware (bleepingcomputer.com)

• Google Files Suit Against Cameroonian Cyber Criminal Who Used Puppies as Lures - CyberScoop

Cryptocurrency/Cryptomining/Cryptojacking

• 10 NFT and Cryptocurrency Security Risks That CISOs Must Navigate | CSO Online

• A Practical Reason Why Crypto Might Not Work for Large-Scale Sanctions Evasion - CyberScoop

Insider Risk and Insider Threats

• Who Is Your Biggest Insider Threat? | CSO Online

• Former DHS Acting IT Chief Convicted in Software, Database Theft Scheme (darkreading.com)

Fraud, Scams & Financial Crime

• Cyber Criminals Do Their Homework for Latest Banking Scam • The Register

Denial of Service DoS/DDoS

• New Fodcha DDoS Botnet Targets Over 100 Victims Every Day (bleepingcomputer.com)

• New EnemyBot DDoS Botnet Borrows Exploit Code from Mirai and Gafgyt (thehackernews.com)

Cloud

• 99% Of Cloud Identities Are Overly Permissive, Opening Door to Attackers | CSO Online

• The Perils of SaaS Misconfigurations - Help Net Security

• Top Attack Techniques for Breaching Enterprise And Cloud Environments - Help Net Security

• Finding Attack Paths in Cloud Environments (thehackernews.com)

• The Two Words You Should Never Forget When You’re Securing a Cloud - Help Net Security

Privacy

• Muting Your Mic Reportedly Doesn’t Stop Big Tech from Recording Your Audio (thenextweb.com)

Spyware, Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• Preparing for Armageddon: How Ukraine Battles Russian hackers | Ars Technica

• Ukraine Proves Cyber War Has No Borders - MSSP Alert

• Hackers Target Ukrainian Govt with IcedID Malware, Zimbra Exploits (bleepingcomputer.com)

• Russia’s Sandworm Hackers Attempted a Third Blackout In Ukraine | Ars Technica

• The Unceasing Action of Anonymous Against Russia - Security Affairs

• European Officials Reportedly Targeted by NSO Spyware • The Register

---

Nation State Actors

Nation State Actors – Russia

• CISA Warns Orgs of WatchGuard Bug Exploited by Russian State Hackers (bleepingcomputer.com)

Nation State Actors – China

• China-Linked Hafnium APT Leverages Tarrask Malware to Gain Persistence - Security Affairs

• China ‘Decodes’ An Orbiting US Satellite; Claims Expertise In Automatically Detecting & Fixing Security Flaws In Outer Space (eurasiantimes.com)

Nation State Actors – North Korea

• US Gov Believes Lazarus APT is Behind Ronin Validator Cyber Heist - Security Affairs

• Feds Offer $5m Reward for Info on North Korean Cyber Crooks • The Register

• FBI Links Largest Crypto Hack Ever to North Korean Hackers (bleepingcomputer.com)

• Symantec: North Korea's Lazarus Targets Chemical Companies • The Register

---

Vulnerabilities

• Microsoft Issues Patches for 2 Windows Zero-Days and 126 Other Vulnerabilities (thehackernews.com)

• Google Issues Third Emergency Fix For Chrome This Year • The Register

• Critical HP Teradici PCoIP Flaws Impact 15 Million Endpoints (bleepingcomputer.com)

• Critical Windows RPC Vulnerability Raises Alarm (techtarget.com)

• VMware Workspace One Flaw Actively Exploited in The Wild (techtarget.com)

• Adobe Patches Gaping Security Holes in Acrobat, Reader, Photoshop | SecurityWeek.Com

• Cisco Vulnerability Lets Hackers Craft Their Own Login Credentials (bleepingcomputer.com)

• Critical VMware Cloud Director Bug Could Let Hackers Takeover Entire Cloud Infrastructure (thehackernews.com)

• Several Vulnerabilities Allow Disabling of Palo Alto Networks Products | SecurityWeek.Com

• Cisco Patches Critical Vulnerability in Wireless LAN Controller | SecurityWeek.Com

• Critical Flaw in Elementor WordPress Plugin May Affect 500k Sites (bleepingcomputer.com)

• Critical Apache Struts RCE Vulnerability Wasn't Fully Fixed, Patch Now (bleepingcomputer.com)

• Attackers Are Exploiting VMware RCE to Deliver Malware (CVE-2022-22954) - Help Net Security

• These D-Link Routers Are Vulnerable To Remote Hacks And Should Be Retired Immediately | HotHardware

• Upgrades for Spring Framework Have Stalled (darkreading.com)

---

Sector Specific

CNI, OT, ICS, IIoT and SCADA

• CISA Alert on ICS, SCADA Devices Highlights Growing Enterprise IoT Security Risks (darkreading.com)

• Pipedream Malware: Feds Uncover 'Swiss Army Knife' for Industrial System Hacking | WIRED

• New Malware Tools Pose 'Clear and Present Threat' to ICS Environments (darkreading.com)

• US Warns of APT Hackers Targeting ICS/SCADA Systems with Specialized Malware (thehackernews.com)

• Flaws in ABB Network Interface Modules Expose Industrial Systems to DoS Attacks | SecurityWeek.Com

Energy & Utilities

• US Agencies Warn of Custom-Made Hacking Tools Targeting Energy Sector Systems - The Record by Recorded Future

---

Reports Published in the Last Week

• The 2021 State Of Enterprise Breaches | Forrester

• First Quarter 2022 Data Breach Analysis Report | Identity Theft Resource Centre
  

---

Other News

• Singapore To License Infosec Service Providers • The Register

• What Is the Cyber Kill Chain? A Model for Tracing Cyber Attacks | CSO Online

• Cyber Defense: Prioritized By Real-World Threat Data - Help Net Security

• How Can You Spot Fake News? And What Should We, As A Society, Do About Mass Disinformation? - Information Security Buzz

• The Cyber Criminal Isn’t Necessarily Who You Think… | Mind Matters

• Consumer Trust Is in The Doldrums: Indifference Towards Data Exposure Is Widespread - Help Net Security

• How Cryptocurrency Gave Birth to the Ransomware Epidemic (vice.com)

• Dark Data Is a Pain Point For Many Security Leaders - Help Net Security

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.