Windows, macOS Hacked at Pwn2Own 2017

Researchers hacked Windows, macOS, Firefox, Edge, Safari and Flash Player on the second day of the Pwn2Own 2017 competition taking place these days alongside the CanSecWest conference in Vancouver, Canada.

On the first day, participants successfully demonstrated exploits against Edge, Safari, Ubuntu and Adobe Reader, taking home over $230,000 of the $1 million prize pool. On the second day, white hat hackers earned $340,000 for their exploits.

Adobe Flash Player was successfully targeted by both Qihoo360’s 360 Security team and Tencent’s Team Sniper, each earning $40,000 for their exploits. 360 Security used four bugs, while Team Sniper leveraged two use-after-free vulnerabilities.

The Qihoo360 team also managed to break Apple’s macOS operating system, earning $10,000 for a privilege escalation that involved an information disclosure flaw and a race condition in the kernel. The same amount was earned by the Chaitin Security Research Lab team, which elevated privileges on macOS via an information disclosure bug and an out-of-bounds in the kernel.

360 Security also earned $35,000 for hacking Apple’s Safari browser and escalating privileges to root on macOS. Team Sniper was paid the same amount for an exploit chain that achieved the same goal.

The Windows operating system was hacked by both 360 Security and Team Sniper, each taking home $15,000 for exploits that involved out-of-bounds and integer overflow vulnerabilities in the kernel.

Microsoft’s Edge browser was successfully targeted on the second day of Pwn2Own 2017 by two groups from Tencent: Team Sniper and Sword Team. They each received $55,000 for disclosing their exploits.

Mozilla Firefox was hacked by the Chaitin Security team via an integer overflow in the browser and an uninitialized buffer weakness in the Windows kernel for privilege escalation. Moritz Jodeit of Blue Frost Security also targeted Firefox, but failed to complete the exploit chain in the allocated timeframe.

Some of the Tencent teams – the Chinese firm had four teams in the competition – withdrew their entries or were disqualified for not using zero-day vulnerabilities.

Due to the unprecedented number of contestants and entries, some of the exploits will be demonstrated on the third day of the event, when participants will take a crack at Edge, including with a VM escape, and VMware Workstation. Depending on the results, the total amount paid out this year could exceed $800,000, nearly double compared to Pwn2Own 2016. 

Hackers Earn Big Bounties for GitHub Enterprise Flaws

White hat hackers have earned tens of thousands of dollars in bounties after finding serious vulnerabilities in GitHub Enterprise.

GitHub Enterprise is the on-premises version of GitHub.com, for which organizations pay an annual fee of $2,500 for every 10 users. The product promises enterprise-grade security, 24/7 technical support, hosting options, and several administration features not available for GitHub.com.

GitHub Enterprise versions 2.8.5, 2.8.6 and 2.8.7, released in January, patch several flaws rated critical and high severity, including ones that can be exploited to bypass authentication and remotely execute arbitrary code.

The researchers who discovered the vulnerabilities have started making their findings public, and information from GitHub and the experts themselves shows that they earned significant rewards.

GitHub included the Enterprise product in its bug bounty program at the beginning of the year, when it announced that the most severe bugs reported in January and February would also receive bonus rewards.

Two of the vulnerabilities rated critical were identified by Greece-based researcher Ioannis Kakavas. The expert discovered a couple of flaws in the Security Assertion Markup Language (SAML) implementation of GitHub Enterprise, and received a research grant to conduct a full assessment of SAML in GitHub.

Kakavas, who is currently the second best hacker in GitHub’s bug bounty program, earned a total of $27,000 for the flaws he uncovered. He recently published a blog post containing technical details and proof-of-concept (PoC) code.

Another critical flaw was discovered by German bug bounty hunter Markus Fenske. The expert found a weakness in the management console that could have been exploited to execute arbitrary commands on the GitHub Enterprise appliance.

Fenske has received a total of $18,000 for his findings, which includes a $10,000 bounty, the maximum reward offered by GitHub, and an $8,000 bonus.

Researcher Orange Tsai, who last year managed to hack a Facebook server, received $5,000 and a $5,000 bonus for responsibly disclosing a high severity SQL injection vulnerability related to the pre-receive hook APIs used by GitHub Enterprise.

GitHub said there was no evidence that the vulnerabilities identified by Fenske and Kakavas had been exploited in the wild.

Germany Accuses Russia of Hybrid Warfare

Russia has been accused of waging its own brand of cyber hybrid warfare against Germany, with specific focus on next year's elections. In particular, the APT28 (Fancy Bear) hacking group -- thought to be linked to the Russian government -- is accused of spreading propaganda and disinformation under the guise of 'hacktivists'.

The recent attack on Deutsche Telekom routers is thought by some experts to have emanated from Russia, but there is no proof. Last year's attack against the German parliament, and attacks against German politicians in August, are also blamed on Russia. Speaking earlier this week, Chancellor Angela Merkel commented, "Such cyber-attacks, or hybrid conflicts as they are known in Russian doctrine, are now part of daily life and we must learn to cope with them."

Now both the heads of the German foreign intelligence agency (BND), Bruno Kahl, and the domestic intelligence agency (BfV), Hans-Georg Maassen, have warned about increasing Russian cyber activity in Germany. 

Last week Kahl told the Süddeutsche Zeitung, "There are findings that cyber-attacks take place which have no other meaning than to create political uncertainty. There is a kind of pressure on public discourse and on democracy, which is unacceptable." He added that there are indications of Russian involvement. "Attribution to a state actor is technically difficult, but there is some evidence that it is at least tolerated or desired by the state."

Yesterday, however, a statement issued by the BfV was more forthright. "Since the start of the Ukraine crisis," it started, "we have seen a significant increase in Russian propaganda and disinformation campaigns in Germany." It warns of a broad spectrum of instruments and "an enormous use of financial resources on Russia's part" designed to strengthen extremist groups in order to shape political discourse in Germany.

The statement names APT28 as using a campaign that is often executed as 'false flags'. "This approach represents a previously unseen methodology in campaigns that are controlled by Russia." Note however, that many experts believe that the attack against French television company TV5  was also a 'false flag': in reality APT28 pretending to be ISIS.

The statement goes on to say, "Spear-phishing against political parties and parliamentary groups have increased dramatically. They are attributed to the APT28 campaign, which was also responsible for the DNC hack. APT28 successfully exfiltrated data from the German Bundestag in 2015."

Maassen describes the method and motivation behind the APT28 campaign. "Propaganda, disinformation, cyber-attacks, cyber espionage and cyber sabotage are part of hybrid threats against western democracies." He points to social networks as the new way for people to share and consume information, adding that it provides the perfect entry point for disinformation and campaigns designed to reshape public opinion.

He also warns of an "increase in cyber espionage within the political arena". Government officials, members of the Bundestag, and party workers all face a potential threat. "Stolen information could be used in the election campaign to discredit German politicians."

The political theory is that Russia will benefit from a weakened European Union -- already wounded by Brexit. By playing to European concerns over uncontrolled immigration and refugee support, and by fostering nationalism within individual member states -- in this instance Germany -- Russia will be able to weaken the existing European sanctions.

Russia denies involvement in hacking.

Yahoo Pays Out $10,000 Bounty for Critical Mail Flaw

A researcher has earned $10,000 for finding a critical Yahoo! Mail vulnerability that could have been exploited simply by getting the targeted user to open a specially crafted email.

Nearly one year ago, Jouko Pynnönen of Finland-based software company Klikki Oy discovered a stored cross-site scripting (XSS) vulnerability in the web version of the Yahoo! Mail service that could have allowed an attacker to execute malicious JavaScript code hidden in emails.

The researcher said the flaw could have been used to forward the victim’s emails, change their account settings and even create an email worm that attached itself to all outgoing emails.

The vulnerability, which earned Pynnönen $10,000, existed due to Yahoo’s failure to properly sanitize code in HTML emails.

The expert recently decided to take another look at Yahoo’s Mail service and discovered a similar flaw, but this time it was related to code inserted when certain type of content is attached to an email.

The “Share files from cloud providers" attachment option allows users to attach files from their cloud storage accounts, such as Dropbox or Google Drive. While analyzing the code inserted into an email when this option was used, Pynnonen noticed some HTML attributes named data-* (e.g. data-url, data-category, data-embed-url). Further analysis showed that these attributes are also used when a YouTube video is added to an email.

The researcher found a way to abuse these attributes in YouTube video attachments to get arbitrary JavaScript code executed. There was no need for the user to click on a link or open an attachment – the code would get executed as soon as the email was opened.

Similar to the flaw discovered one year ago, this security hole could have been exploited to steal a user’s emails and create a worm that spreads by attaching itself to outgoing emails, the expert said.

Pynnönen told SecurityWeek that he did not get a chance to test the attack method using the Google Drive and Dropbox attachment options. Yahoo was informed about the vulnerability on November 12 and fixed it by the end of November.

Yahoo awarded the expert a $10,000 bounty for the flaw. The company reported in May that it had paid out more than $1.6 million since the launch of its public bug bounty program in 2013.

Cyber Insurance Market to Top $14 Billion by 2022: Report

The global cyber insurance market is expected to generate $14 billion by 2022, according to a new report published by Allied Market Research (AMR). That figure represents an impressive compound annual growth rate (CAGR) of nearly 28% from 2016 to 2022.

North America constituted the largest cyber insurance market share in 2015, which is expected to dominate the market during the forecast period.

"Increase in awareness about cyber risks from boardroom to data centers owing to the rising number of cyber-attacks in the past 2-3 years is the prime factor that drives the market," the report explains. "However, complex and changing nature of cyber risks limits cyber insurance market growth. Low market penetration of cyber insurance policies in developing countries offers promising business opportunity for market players."

In terms of verticals, healthcare organizations currently generate roughly one-third of the total premiums, the report said, noting that in the United States approximately 78% of hospitals do have a cyber insurance policy.

In terms of orgaziational size, large companies generated approximately 70% of the overall cyber insurance market revenue in 2015, with North America dominating the industry with around 87% of the overall cyber insurance market last year.

“Mandatory legislation regarding cyber security in several U.S. states has led to higher penetration of cyber liability insurance policies,” AMR explained. “The U.S. cyber 

insurance industry has become mature, and growth of the cyber insurance industry is projected to decrease owing to rising adoption of cyber liability insurance policies. Europe has very less penetration of cyber insurance liability policies as compared to that of the U.S. The European council has recently passed regulations regarding data protection and security, which are projected to be brought into effect in 2018. These regulations would oblige companies to purchase cyber insurance policies. Though Asia-Pacific accounts for negligible percentage share, it is expected to grow at a significant CAGR during the forecast period owing to a significant increase in ransomware attacks.”

By comparison, a report (PDF) from PwC estimate that annual gross written premiums are set to increase from around $2.5 billion in 2015 to $7.5 billion by 2020.

“The cyber insurance market will Cyber insurance is a potentially huge, but still largely untapped, opportunity for insurers and reinsurers,” PwC said. 

“Many insurers face considerable cyber exposures within their technology, errors & omissions, general liability and other existing business lines,” PwC cautioned. “The immediate priority is to evaluate and manage these ‘buried’ exposures.”

"Cybercrime is still a serious threat and no longer is considered as a risk covered under traditional network security insurance product," Yogiata Sharma, Research Analyst, Consumer Goods Research at AMR, said in a statement. "Organizations from all industries need coverage for liability and property exposure which is a result of cyber-attacks. This is an opportunity for insurers and reinsurers to innovate cyber insurance products that manage various degrees of risks and cover cost-associated data breaches, credit monitoring, forensic investigations, reputation management, and business interruption." 

Key players in the cyber insurance market include American International Group (AIG), Chubb, Zurich Insurance, XL Group Ltd (Ireland), Berkshire Hathaway (U.S.), Allianz Global (Germany), Munich Re Group (Germany), Lloyd's (U.K.), Lockton (U.S.), and AON PLC (U.K.).

While cyber insurance can help companies cover costs associated with damaging cyber attacks and data loss, it’s important to remember what cannot be covered, such as theft of intellectual property and remediation of a breach, reminds SecurityWeek contributor Joshua Goldfarb.

“It’s easy to cynically view cyber insurance as yet another fad creating noise in the already crowded security market,” Goldfarb writes. “What’s harder is truly understanding all of the necessary components in a sound and strategic risk mitigation strategy. Cyber insurance, like any tool, will not solve all of an organization’s problems. But it can help an organization round out its risk mitigation strategy.

Russia Says Thwarted Fresh Cyber Attacks on Major Banks

Russia's telecom operator on Friday said that it had blocked a series of cyber attacks on the country's leading banks this week, the latest to target the country's financial sector.

Rostelecom said in a statement that it "successfully thwarted DDoS (distributed denial of service) on the five biggest banks and financial organisations in Russia" on December 5.

"The most sustained attack lasted more than two hours," it said.

Russia's FSB security service last week said it had uncovered plans by foreign intelligence services to carry out massive cyber attacks targeting the country's financial system from December 5.

State-controlled Russian bank VTB said Monday that its websites had been hit by a cyber attack but insisted its systems were still working "as normal".

The FSB did not say which countries' secret services were involved in the latest plot against Russian banks but alleged the attacks would use servers and "command centres" located in the Netherlands belonging to Ukrainian hosting company, BlazingFast.

Russia has been embroiled in a hacking scandal with the US over allegations from Washington that Moscow was behind the theft and leaking of documents online during the run-up to the US presidential election aimed at influencing the outcome.

Vice President Joe Biden warned that the US would respond to the suspected Russian hacking "at the time of our choosing and under the circumstances that have the greatest impact".

The latest attacks comes after Moscow-based security giant Kaspersky said in November that a massive DDoS cyber attack had hit at least five of Russia's largest banks.

DDoS attacks involve flooding websites with more traffic than they can handle, making them difficult to access or taking them offline entirely.

Kaspersky said those attacks used devices located in 30 countries including the United States.

Floki Bot Developer Imports Cybercrime Tools to Brazil

Cisco Talos and Flashpoint have teamed up to conduct an in-depth analysis of Floki Bot, a Zeus-based banking Trojan that has been sold on cybercrime marketplaces since September 2016.

Floki Bot, offered by its developers for $1,000 worth of bitcoins, is based on the Zeus source code that was leaked in 2011. However, researchers determined that the malware includes some new capabilities, including anti-detection features. Talos also spotted new code that allows the Trojan to use the Tor network, but the functionality is currently not active.

Flashpoint analysts believe that “flokibot,” the online moniker used by the threat actor behind the Floki Bot malware, is based in Brazil. Researchers determined that the actor communicates in Portuguese, it targets Brazilian IPs and domains, and it’s mainly interested in devices with the default language set to Portuguese. The actor appears to be most active on underground forums during hours within Brazil’s UTC -3 timezone.

Flashpoint has named the flokibot actor a “connector”, as they are present on several major underground communities outside of Brazil, particularly Russian- and English-speaking dark web communities.

Researchers believe that through their presence on these foreign websites, the cybercriminals import knowledge and tools into the Brazilian community.

“While Brazilian cybercriminals are not typically as technically sophisticated as their Russian counterparts, they will often solicit new forms of malware (to include point of sale [PoS] ransomware and banking Trojans), or offer their own services,” Vitali Kremez, senior intelligence analyst at Flashpoint, said in a blog post. “It appears that a presence on Russian [Deep and Dark Web] communities may be a likely factor in flokibot’s progression.”

In addition to the banking Trojan functionality borrowed from Zeus, researchers noticed that Floki Bot includes hooking methods designed to capture payment card data from memory. In one campaign analyzed by Flashpoint, 225 Floki bots appeared to have collected a total of 1,375 card dumps.

“For connectors like flokibot, reaching across language barriers into predominantly English- and Russian-language communities enables them to to advance criminal schemes through new markets: it is not particularly difficult or expensive for botnet newcomers in short time to build their own botnets leveraging Floki Bot and start attacking corporate networks,” Kremez said.

Talos has published a detailed analysis of how Floki Bot works and released a tool designed to make it easier for analysts to examine the malware.