今週の気になるセキュリティニュース - Issue #156

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

ブラジルの法執行機関が Grandoreiro マルウェアのインフラを摘発し、容疑者を逮捕

(1/30) PF combate organização criminosa que praticava fraudes bancárias eletrônicas contra vítimas no exterior — Polícia Federal

(1/30) ESET takes part in global operation to disrupt the Grandoreiro banking trojan

ESET has collaborated with the Federal Police of Brazil in an attempt to disrupt the Grandoreiro botnet. ESET contributed to the project by providing technical analysis, statistical information, and known command and control (C&C) server domain names and IP addresses. Due to a design flaw in Grandoreiro’s network protocol, ESET researchers were also able to get a glimpse into the victimology.

(1/30) Police disrupt Grandoreiro banking malware operation, make arrests


埼玉県健康づくり事業団が所有する X 線画像読影システムでランサムウェア感染被害

(1/31) X 線画像読影システムへの不正アクセスについて

(2/1) 漏えいの可能性も…埼玉で年間40万人が健康診断する法人、サイバー攻撃され復旧未定 X線画像読影システム、画像など暗号化され身代金要求される ランサムウエアは「ロックビット」、今後は ｜ 埼玉新聞


求人情報サイト「バイトル」で求人掲載企業の管理画面への不正ログインによる情報漏洩

(1/31) 不正ログインによる個人情報漏洩のお知らせとお詫び/保育・物流業界の人材派遣・人材紹介 / SESなら株式会社サンライズワークス

弊社が求人情報を掲載しておりますディップ株式会社（以下、ディップ社）の運営にかかる求人情報サイト「バイトル」において、弊社の応募者情報管理画面（以下、本件管理画面）への不正ログインが行われ、2023年1月から同年11月に「バイトル」を利用して弊社にご応募いただいた方（以下、応募者様）のうち20名の応募情報の一部と上記不正ログインに使用されたID・パスワードが記載されたメール（以下、本件メール）が、本件管理画面のメール送信機能を利用して、外部へ送信された事実が判明いたしました。 そのため、本件管理画面に保存されていた応募者様1296名分の応募情報が、不正ログインを行った第三者及び本件メールに記載されたID・パスワードを用いてアクセスした者に閲覧された可能性があります。

なお、送信された個人情報および 閲覧された可能性のある個人情報は後記の通りであり、クレジットカード情報は含まれておりません。 また、現時点で、不正ログインに使用されたID・パスワードが弊社内部から漏洩した事実は確認されておりません。

(1/31) 求人掲載企業の管理画面への不正ログインに関するお詫びとお知らせ | ディップ株式会社


スタンレー電気のグループ会社において、送金詐欺による資金流出被害

(1/31) 当社アジア大洋州グループ会社における資金流出事案について


三浦工業のホームページが改ざん被害

(1/31) 三浦工業：お詫びとご報告

2024年1月26日(金)17時00分頃から1月28日(日)11時21分までの間に、第三者からのサイバー攻撃によりホームページが改ざんされていた事が判明いたしました。 ご利用いただいておりますお客様の皆様には多大なご迷惑、ご心配をお掛けしたことを深くお詫び申し上げます。 現在、原因と影響の調査を進めており、ホームページを閉じさせていただいております。


Ripple Labs の共同創業者である Chris Larsen 氏の個人アカウントが不正アクセスを受け、約 156億円相当の XRP が盗まれる

(1/31) Ripple chairman Chris Larsen hacked for reported 213M XRP worth approximately $112.5M


Cloudflare が昨年 11月に社内システムへの不正アクセスがあったと公表

(2/1) Thanksgiving 2023 security incident

On Thanksgiving Day, November 23, 2023, Cloudflare detected a threat actor on our self-hosted Atlassian server. Our security team immediately began an investigation, cut off the threat actor’s access, and on Sunday, November 26, we brought in CrowdStrike’s Forensic team to perform their own independent analysis.


50ヶ国以上の法執行機関が協力する Operation Synergia により、フィッシングやマルウェア感染に利用される不正な約 1,300 の IP アドレスや URL を特定し摘発

(2/1) INTERPOL-led operation targets growing cyber threats

SINGAPORE – Some 1,300 suspicious IP addresses or URLs have been identified as part of a global INTERPOL operation targeting phishing, malware and ransomware attacks.

Operation Synergia, which ran from September to November 2023, was launched in response to the clear growth, escalation and professionalisation of transnational cybercrime and the need for coordinated action against new cyber threats.

The operation involved 60 law enforcement agencies from more than 50 INTERPOL member countries, with officers conducting house searches and seizing servers as well as electronic devices. To date, 70% of the command-and-control (C2) servers identified have been taken down, with the remainder currently under investigation.


AnyDesk が社内システムへの不正アクセスがあったと発表

(2/2) AnyDesk Incident Response 2-2-2024


攻撃、脅威

Coveware が 2023年第 4四半期のランサムウェアレポートを公開

(1/26) New Ransomware Reporting Requirements Kick in as Victims Increasingly Avoid Paying


JC3 が KeepSpy および XLoader/MoqHao マルウェアに関する注意喚起

(1/30) あなたのスマホがフィッシングサイトをばら撒く！ | トピックス | 脅威情報 | 一般財団法人日本サイバー犯罪対策センター（JC3）


米司法省は中国の攻撃者グループ Volt Typhoon が使用する KV ボッネットを感染機器から削除する作戦を実施

(1/31) Office of Public Affairs | U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure | United States Department of Justice

The vast majority of routers that comprised the KV Botnet were Cisco and NetGear routers that were vulnerable because they had reached “end of life” status; that is, they were no longer supported through their manufacturer’s security patches or other software updates. The court-authorized operation deleted the KV Botnet malware from the routers and took additional steps to sever their connection to the botnet, such as blocking communications with other devices used to control the botnet.

(1/31) China's Hackers Have Entire Nation in Their Crosshairs, FBI Director Warns — FBI

(1/31) CISA and FBI Release Secure by Design Alert Urging Manufacturers to Eliminate Defects in SOHO Routers | CISA


トビラシステムズが「詐欺SMSモニター」を公開

(2/1) 詐欺SMSの発生状況がリアルタイムでわかる？！「詐欺SMSモニター」 ｜トビラシステムズ（証券コード：4441）

詐欺SMSモニター


脆弱性

Jenkins に複数の脆弱性。PoC も公開

(1/24) Jenkins Security Advisory 2024-01-24

(1/24) Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins | Sonar

(1/28) Exploits released for critical Jenkins RCE flaw, patch now

(1/30) CVE-2024-23897: Jenkins - Censys

As of January 30, 2024, Censys has observed 83,509 Jenkins servers on the internet, 79,952 (~96%) of which are potentially vulnerable.

(参考) Jenkinsの脆弱性 CVE-2024-23897 についてまとめてみた - piyolog


Hitron Systems 製の複数の DVR に脆弱性。すでに悪用が確認されている

(1/30) Actively Exploited Vulnerability in Hitron DVRs: Fixed, Patches Available | Akamai

As part of the InfectedSlurs discovery, the Akamai SIRT uncovered vulnerabilities in multiple Hitron DVR device models that are actively exploited in the wild. Hitron devices are manufactured in South Korea by Hitron Systems.

The vulnerability allows an authenticated attacker to achieve OS command injection with a payload delivered via a POST request to the management interface. In its current configuration, it is utilizing device default credentials in the captured payloads.

(1/31) JVNVU#93639653: 複数のHitron Systems製デジタルビデオレコーダにおける不適切な入力確認の脆弱性


Ivanti Connect Secure と Ivanti Policy Secure に新たな脆弱性。すでに悪用が確認されている。

(1/31) Security Update for Ivanti Connect Secure and Ivanti Policy Secure Gateways

As part of our ongoing strengthening of the security of our products we have discovered new vulnerabilities in Ivanti Connect Secure (formerly Pulse Secure) and Ivanti Policy Secure gateways. We are reporting these vulnerabilities as CVE-2023-46805 and CVE-2024-21887. These vulnerabilities impact all supported versions of the products. Mitigations are available now.

(1/31) CVE-2024-21888 Privilege Escalation for Ivanti Connect Secure and Ivanti Policy Secure

We have no evidence of any customers being impacted by CVE-2024-21888 at this time. We are only aware of a small number of customers who have been impacted by CVE-2024-21893 at this time. The table below provides details on the vulnerabilities:

(1/31) Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation | Mandiant

In this follow-up blog post, we detail additional tactics, techniques, and procedures (TTPs) employed by UNC5221 and other threat groups during post-exploitation activity across our incident response engagements. We also detail new malware families and variants to previously identified malware families being used by UNC5221. We acknowledge the possibility that one or more related groups may be associated with the activity described in this blog post. It is likely that additional groups beyond UNC5221 have adopted one or more of these tools.

(1/31) Updated: New Software Updates and Mitigations to Defend Against Exploitation of Ivanti Connect Secure and Policy Secure Gateways | CISA

(1/31) Supplemental Direction V1: ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities | CISA

(2/2) CVE-2024-21893 | AttackerKB


CISA が Known Exploited Vulnerabilities (KEV) カタログに 1+1 個の脆弱性を追加

(1/31) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

(1/31) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

  • CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability


Docker と runc にコンテナエスケープ可能な脆弱性

(1/31) Leaky Vessels: Docker and runc Container Breakout Vulnerabilities - January 2024 | Snyk

Snyk security researcher Rory McNamara, with the Snyk Security Labs team, identified four vulnerabilities — dubbed "Leaky Vessels" — in core container infrastructure components that allow container escapes. An attacker could use these container escapes to gain unauthorized access to the underlying host operating system from within the container.

(1/31) Docker Security Advisory: Multiple Vulnerabilities in runc, BuildKit, and Moby | Docker

We at Docker prioritize the security and integrity of our software and the trust of our users. Security researchers at Snyk Labs recently identified and reported four security vulnerabilities in the container ecosystem. One of the vulnerabilities, CVE-2024-21626, concerns the runc container runtime, and the other three affect BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). We want to assure our community that our team, in collaboration with the reporters and open source maintainers, has been diligently working on coordinating and implementing necessary remediations.

(1/31) several container breakouts due to internally leaked fds · Advisory · opencontainers/runc · GitHub


その他

今週の気になるセキュリティニュース - Issue #155

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

昨年発覚した NTT ビジネスソリューションズからの情報の不正な持ち出しに関して、個人情報保護委員会が行政指導

(1/24) 株式会社NTTマーケティングアクトProCX及びNTTビジネスソリューションズ株式会社に対する個人情報の保護に関する法律に基づく行政上の対応について（令和６年１月24日） ｜個人情報保護委員会

(1/24) 当社に対する個人情報保護委員会からの勧告および指導について｜ニュースリリース｜ＮＴＴビジネスソリューションズ

(1/24) 当社に対する個人情報保護委員会からの勧告および指導について - お知らせ｜ＮＴＴマーケティングアクトＰｒｏＣＸ


HPE がロシアの攻撃者グループ Midnight Blizzard による攻撃を受け、Microsoft 365 メールアカウントが侵害されたことを公表

(1/24) hpe-20240119

On December 12, 2023, Hewlett Packard Enterprise Company (the “Company,” “HPE,” or “we”) was notified that a suspected nation-state actor, believed to be the threat actor Midnight Blizzard, the state-sponsored actor also known as Cozy Bear, had gained unauthorized access to HPE’s cloud-based email environment. The Company, with assistance from external cybersecurity experts, immediately activated our response process to investigate, contain, and remediate the incident, eradicating the activity. Based on our investigation, we now believe that the threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions.

While our investigation of this incident and its scope remains ongoing, the Company now understands this incident is likely related to earlier activity by this threat actor, of which we were notified in June 2023, involving unauthorized access to and exfiltration of a limited number of SharePoint files as early as May 2023. Following the notice in June, we immediately investigated with the assistance of external cybersecurity experts and took containment and remediation measures intended to eradicate the activity. Upon undertaking such actions, we determined that such activity did not materially impact the Company.

We have notified and are cooperating with law enforcement and are also assessing our regulatory notification obligations, and we will make notifications as appropriate based on our investigation findings. As of the date of this filing, the incident has not had a material impact on the Company’s operations, and the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

(1/24) HPE: Russian hackers breached its security team’s email accounts


スリー・ディー・マトリックスで送金詐欺による資金流出被害

(1/25) 送金詐欺による資金流出被害のお知らせ

株式会社スリー・ディー・マトリックス（本社：東京都千代田区、代表取締役社長：岡田淳）は、2023 年 12 月下旬から 2024 年１月上旬にかけて、取引先を装った複数のメールによる虚偽の支払い指示に応じ、当該取引先の真実の銀行口座と異なる銀行口座に対して誤って代金を支払ってしまう送金詐欺による資金流出被害が生じたことが判明しましたので、お知らせいたします。


Trickbot マルウェアの開発者に禁錮 5年4ヶ月の判決

(1/25) Office of Public Affairs | Russian National Sentenced for Involvement in Development and Deployment of Trickbot Malware | United States Department of Justice

(1/25) Russian TrickBot malware dev sentenced to 64 months in prison


攻撃、脅威

伊藤忠サイバー&インテリジェンスが LODEINFO マルウェアの解析結果を報告

(1/24) 分析官と攻撃者の解析回避を巡る終わりなき戦い: LODEINFO v0.6.6 - v0.7.3 の解析から - ITOCHU Cyber & Intelligence Inc.


ESET が中国の攻撃者グループ Blackwood による NSPX30 マルウェアを利用する攻撃活動について報告

(1/24) NSPX30: A sophisticated AitM-enabled implant evolving since 2005

ESET researchers provide an analysis of an attack carried out by a previously undisclosed China-aligned threat actor we have named Blackwood, and that we believe has been operating since at least 2018. The attackers deliver a sophisticated implant, which we named NSPX30, through adversary-in-the-middle (AitM) attacks hijacking update requests from legitimate software.


Microsoft からロシアの攻撃者グループ Midnight Blizzard による攻撃についての続報

(1/25) Midnight Blizzard: Guidance for responders on nation-state attack | Microsoft Security Blog


脆弱性

ラックがバッファロー製VR-S1000における複数の脆弱性に関する注意喚起

(1/22) 【注意喚起】バッファロー製VR-S1000における複数の脆弱性（CVE-2023-51363）、早急な対策を | LAC WATCH

(2023/12/25) VR-S1000における複数の脆弱性とその対処方法 | バッファロー


GoAnywhere MFT に認証バイパスの脆弱性 (CVE-2024-0204)。PoC も公開される

(1/22) FI-2024-001 - Authentication Bypass in GoAnywhere MFT | Fortra's Security and Trust Center

(1/23) CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive – Horizon3.ai

(1/24) GoAnywhere MFT vulnerabilities are Going Nowhere for Now - Censys


Apple が macOS Monterey 12.7.3, macOS Ventura 13.6.4, macOS Sonoma 14.3, iOS 15.8.1 / iPadOS 15.8.1, iOS 16.7.5 / iPadOS 16.7.5, iOS 17.3 / iPadOS 17.3, tvOS 17.3, watchOS 10.3, Safari 17.3 をリリース。すでに悪用が確認されている脆弱性の修正を含む。

(1/22) Apple security releases - Apple Support


CISA が Known Exploited Vulnerabilities (KEV) カタログに 1+1+1 個の脆弱性を追加

(1/22) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

(1/23) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

(1/24) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

  • CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection Vulnerability


その他

X (旧 Twitter) が米国の iOS ユーザ向けに passkeys によるログインをサポート

(1/23) How to use passkey


Apple が EU の Digital Markets Act (DMA) に準拠するため、EU を対象に iOS、Safari、App Store に大幅な変更を加えると発表

(1/25) Apple announces changes to iOS, Safari, and the App Store in the European Union - Apple

Apple today announced changes to iOS, Safari, and the App Store impacting developers’ apps in the European Union (EU) to comply with the Digital Markets Act (DMA). The changes include more than 600 new APIs, expanded app analytics, functionality for alternative browser engines, and options for processing app payments and distributing iOS apps. Across every change, Apple is introducing new safeguards that reduce — but don’t eliminate — new risks the DMA poses to EU users. With these steps, Apple will continue to deliver the best, most secure experience possible for EU users.

今週の気になるセキュリティニュース - Issue #154

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

ケーズデンキオンラインショップで不正ログインによるなりすまし注文が発生

(1/17) 通販サイトへの不正ログイン・なりすまし注文の発生について


神奈川県公立高等学校入学者選抜インターネット出願システムで発生していた障害が解消

(1/19) 神奈川県公立高等学校入学者選抜インターネット出願システムの稼動状況について - 神奈川県ホームページ

(1/18) 神奈川県高校入試で「あってはならない想定外」 オンライン出願でGmail使うと不具合 原因と対策は？：東京新聞 TOKYO Web

(1/19) 「高校出願システムからGmailに届かない」問題10日で解消も、「キャリアの迷惑メールフィルターにかかる」問題発覚 - ITmedia NEWS


Microsoft がロシアの攻撃者グループ Midnight Blizzard による攻撃を受け、複数の社員のメールアカウントが侵害されたと報告

(1/19) Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard | MSRC Blog | Microsoft Security Response Center

Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. We are in the process of notifying employees whose email was accessed.


攻撃、脅威

Microsoft がイランの攻撃者グループ Mint Sandstorm (PHOSPHORUS) の攻撃活動について報告

(1/17) New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs | Microsoft Security Blog

Since November 2023, Microsoft has observed a distinct subset of Mint Sandstorm (PHOSPHORUS) targeting high-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the United Kingdom, and the United States. In this campaign, Mint Sandstorm used bespoke phishing lures in an attempt to socially engineer targets into downloading malicious files. In a handful of cases, Microsoft observed new post-intrusion tradecraft including the use of a new, custom backdoor called MediaPl.


Google TAG がロシアの攻撃者グループ COLDRIVER の攻撃活動について報告

(1/18) Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware

Over the years, TAG has analyzed a range of persistent threats including COLDRIVER (also known as UNC4057, Star Blizzard and Callisto), a Russian threat group focused on credential phishing activities against high profile individuals in NGOs, former intelligence and military officers, and NATO governments. For years, TAG has been countering and reporting on this group’s efforts to conduct espionage aligned with the interests of the Russian government. To add to the community’s understanding of COLDRIVER activity, we’re shining light on their extended capabilities which now includes the use of malware.


脆弱性

Atlassian の Confluence Data Center と Confluence Server にリモートコード実行可能な脆弱性 (CVE-2023-22527)

(1/16) CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server | Atlassian Support | Atlassian Documentation


Citrix の NetScaler ADC と NetScaler Gateway に複数の脆弱性。すでに悪用が確認されている

(1/16) NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-6548 and CVE-2023-6549

Exploits of these CVEs on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.


Google が Chrome のゼロデイ脆弱性を修正

(1/16) Chrome Releases: Stable Channel Update for Desktop

Google is aware of reports that an exploit for CVE-2024-0519 exists in the wild.


CISA が Known Exploited Vulnerabilities (KEV) カタログに 1+3+1 個の脆弱性を追加

(1/16) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

  • CVE-2018-15133 Laravel Deserialization of Untrusted Data Vulnerability

(1/17) CISA Adds Three Known Exploited Vulnerabilities to Catalog | CISA

(1/18) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

  • CVE-2023-35082 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability


Ivanti Connect Secure と Ivanti Policy Secure の脆弱性の悪用が拡大していることを受け、CISA が脆弱性対応に関する緊急指令 ED 24-01 を発行

(1/19) ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities | CISA

(1/15) Ivanti Connect Secure VPN Exploitation Goes Global | Volexity

(1/16) CVE-2023-46805 | AttackerKB

(1/18) Ivanti Connect Secure VPN Exploitation: New Observations | Volexity

Additionally, Volexity has continued its investigation into activity conducted by UTA0178 and made a few notable discoveries. The first relates to the GIFTEDVISITOR webshell that Volexity scanned for, which led to the initial discovery of over 1,700 compromised Ivanti Connect Secure VPN devices. On January 16, 2024, Volexity conducted a new scan for this backdoor and found an additional 368 compromised Ivanti Connect Secure VPN appliances, bringing the total count of systems infected by GIFTEDVISITOR to over 2,100.

(1/18) Ivanti Connect Secure Exploited to Install Cryptominers | GreyNoise Blog

(参考) Ivanti Connect Secure、Ivanti Policy Secureの脆弱性 CVE-2023-46805およびCVE-2024-21887についてまとめてみた - piyolog


Mandiant が中国の攻撃者グループによる VMware vCenter Server の脆弱性 CVE-2023-34048 を悪用する攻撃活動について報告

(1/19) Chinese Espionage Group UNC3886 Found Exploiting CVE-2023-34048 Since Late 2021 | Mandiant

While publicly reported and patched in October 2023, Mandiant and VMware Product Security have found UNC3886, a highly advanced China-nexus espionage group, has been exploiting CVE-2023-34048 as far back as late 2021.

(1/17 更新) VMSA-2023-0023.1

VMware has confirmed that exploitation of CVE-2023-34048 has occurred in the wild.


その他

今週の気になるセキュリティニュース - Issue #153

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

米証券取引委員会 (SEC) の X アカウントが乗っ取り被害。「ビットコイン現物 ETF を SEC が承認した」との偽投稿により、市場が混乱。翌日に SEC は承認を正式に発表

(1/9) US SEC’s X account hacked to announce fake Bitcoin ETF approval

(1/10) ビットコイン相場乱高下 「SECがETF承認」偽情報で - 日本経済新聞

(1/10) 米証券取引委のXアカウント ハッキングされ偽投稿で市場混乱 | NHK | アメリカ

(1/10) SEC.gov | Statement on the Approval of Spot Bitcoin Exchange-Traded Products


ジェットスター・ジャパンでシステム障害により、複数の国内便が欠航

(1/12) 1月12日に発生したシステム障害による欠航便の影響について | 重要なお知らせ | ジェットスター

(1/12) ジェットスター 午後7時半すぎにシステム障害復旧 運航を再開 17便が欠航 | NHK | 航空

(1/12) ジェットスター・ジャパンで17便が欠航、原因はパイロット向けシステムの不具合 | 日経クロステック（xTECH）


攻撃、脅威

Cisco Talos が Avast と協力して、Babuk Tortilla ランサムウェアの復号ツールを公開

(1/9) New decryptor for Babuk Tortilla ransomware variant released

  • Cisco Talos obtained executable code capable of decrypting files affected by the Babuk Tortilla ransomware variant, allowing Talos to extract and share the private decryption key used by the threat actor.
  • Cisco Talos shared the key with our peers at Avast for inclusion in the Avast Babuk decryptor released in 2021. The decryptor includes all known private keys, allowing many users to recover their files once encrypted by different Babuk ransomware variants.
  • Dutch Police, acting on threat intelligence supplied by Talos, identified, apprehended and the Dutch Prosecution Office prosecuted the threat actor behind Babuk Tortilla operations, demonstrating the power of cooperation between law enforcement agencies and commercial security organizations such as Talos and Avast.

(1/9) Avast Updates Babuk Ransomware Decryptor in Cooperation with Cisco Talos and Dutch Police - Avast Threat Labs

Babuk, an advanced ransomware strain, was publicly discovered in 2021. Since then, Avast has blocked more than 5,600 targeted attacks, mostly in Brazil, Czech Republic, India, the United States, and Germany.

Today, in cooperation with Cisco Talos and Dutch Police, Avast is releasing an updated version of the Avast Babuk decryption tool, capable of restoring files encrypted by the Babuk variant called Tortilla. To download the tool, click here.


Akamai が 2023年の DDoS 攻撃の傾向について報告

(1/9) A Retrospective on DDoS Trends in 2023 and Actionable Strategies for 2024 | Akamai


Cloudflare が 2023年第 4四半期の DDoS 攻撃レポートを公開

(1/9) DDoS threat report for 2023 Q4


Mandiant が暗号資産の Solana を狙う攻撃キャンペーンについて報告。自身の X アカウント乗っ取り被害と関連。

(1/10) Hundreds of Thousands of Dollars Worth of Solana Cryptocurrency Assets Stolen in Recent CLINKSINK Drainer Campaigns | Mandiant


奇安信の Xlab が Mirai 亜種 Rimasuta の活動状況について報告

(1/10) Rimasuta New Variant Switches to ChaCha20 Encryption Algorithm


Akamai が Mirai 亜種 NoaBot の活動状況について報告

(1/10) You Had Me at Hi — Mirai-Based NoaBot Makes an Appearance | Akamai


脆弱性

CISA が Known Exploited Vulnerabilities (KEV) カタログに 6+1+2 個の脆弱性を追加

(1/8) CISA Adds Six Known Exploited Vulnerabilities to Catalog | CISA

(1/10) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

(1/10) CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

  • CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
  • CVE-2023-46805 Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability


Microsoft が 2024年 1月の月例パッチを公開

(1/9) 2024 年 1 月のセキュリティ更新プログラム (月例) | MSRC Blog | Microsoft Security Response Center

(1/9) Zero Day Initiative — The January 2024 Security Update Review


Ivanti Connect Secure と Ivanti Policy Secure にゼロデイ脆弱性。すでに悪用が確認されている。

(1/10) CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways

(1/10) KB CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways

(1/10) Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN | Volexity

Volexity has uncovered active in-the-wild exploitation of two vulnerabilities allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. An official security advisory and knowledge base article have been released by Ivanti that includes mitigation that should be applied immediately. However, a mitigation does not remedy a past or ongoing compromise. Systems should simultaneously be thoroughly analyzed per details in this post to look for signs of a breach.

(1/11) Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation | Mandiant

On January 10, 2024, Ivanti disclosed two vulnerabilities, CVE-2023-46805 and CVE-2024-21887, impacting Ivanti Connect Secure VPN (“CS”, formerly Pulse Secure) and Ivanti Policy Secure (“PS”) appliances. Successful exploitation could result in authentication bypass and command injection, leading to further downstream compromise of a victim network. Mandiant has identified zero-day exploitation of these vulnerabilities in the wild beginning as early as December 2023 by a suspected espionage threat actor, currently being tracked as UNC5221.


GitLab が複数の脆弱性を修正

(1/11) GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 | GitLab

(1/12) GitLab warns of critical zero-click account hijacking vulnerability


その他

今週の気になるセキュリティニュース - Issue #152

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

1月1日に令和6年能登半島地震が発生

(参考) 令和6年能登半島地震の偽情報関連の報道についてまとめてみた - piyolog


スペインの通信会社 Orange España の RIPE NCC アカウントが不正アクセスされ、BGP の不正な設定により通信障害が発生

(1/3) Hacker hijacks Orange Spain RIPE account to cause BGP havoc

Orange Spain suffered an internet outage today after a hacker breached the company's RIPE account to misconfigure BGP routing and an RPKI configuration.

(1/3) Infostealer infection of an Orange employee results in BGP disruptions | InfoStealers

The Orange employee had their computer infected by a Raccoon type Infostealer on September 4th 2023, and among the corporate credentials identified on the machine, the employee had specific credentials to “https://access.ripe.net” using the email address which was revealed by the threat actor (adminripe-ipnt@orange.es).

It is also worth noting that the password that was used on Orange’s RIPE administrator account was “ripeadmin” which is ridiculously weak.

(1/3) RIPE NCC Access: Security Breach Investigation — RIPE Network Coordination Centre

We are currently investigating the compromise of a RIPE NCC Access account, which resulted in some services of the account holder being temporarily impacted.

(1/4) Digging into the Orange España Hack | Kentik Blog

Orange España, Spain’s second largest mobile operator, suffered a major outage on January 3, 2024. The outage was unprecedented due to the use of RPKI, a mechanism designed to protect internet routing security, as a tool for denial of service. In this post, we dig into the outage and the unique manipulation of RPKI.


Mandiant の X アカウントが乗っ取り被害

(1/3) Mandiant’s account on X hacked to push cryptocurrency scam

The Twitter account of American cybersecurity firm and Google subsidiary Mandiant was hijacked earlier today to impersonate the Phantom crypto wallet and share a cryptocurrency scam.

(1/4) Mandiant, the security firm Google bought for $5.4 billion, gets its X account hacked | Ars Technica

Google-owned security firm Mandiant spent several hours trying to regain control of its account on X (formerly known as Twitter) on Wednesday after an unknown scammer hijacked it and used it to spread a link that attempted to steal cryptocurrency from people who clicked on it.


全国の複数の自治体に爆破予告のファックスが届く

(1/4) ＜独自＞「公共施設を爆破する」 全国の複数自治体に爆破予告 能登半島地震で震度５強の糸魚川市も - 産経ニュース


米司法省が 2019年に摘発した xDedic Marketplace に関与したとされる容疑者 19人を訴追

(1/4) Middle District of Florida | 19 Individuals Worldwide Charged In Transnational Cybercrime Investigation Of The xDedic Marketplace | United States Department of Justice


浜松市中央区役所でシステムのバッチ処理不具合により、証明書発行が一時停止

(1/4) 浜松市でシステムダウン、住民票など一時発行できず データベース検索で負荷か、現在は復旧｜静岡新聞アットエス

(1/4) システム障害で一時証明書が発行できず ヒューマンエラーか…１日スタートの行政区再編とは無関係 浜松市中央区役所 - LOOK 静岡朝日テレビ

(1/5) 浜松市中央区役所で一時戸籍証明書など発行できず、原因はバッチ処理の不具合 | 日経クロステック（xTECH）


攻撃、脅威

奇安信の Xlab が Mirai 亜種 Mirai.TBOT の活動状況について報告

(1/3) Mirai.TBOT Uncovered: Over 100 Groups and 30,000+ Infected Hosts in a big IoT Botnet

(コメント) 2023年11月に Akamai が報告した InfectedSlurs と同じボットネット


脆弱性

CISA が Known Exploited Vulnerabilities (KEV) カタログに 2 個の脆弱性を追加

(1/2) CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA


その他

今週の気になるセキュリティニュース - Issue #151

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

中小企業等事業再構築促進事業において事務局の元職員が不正に情報を持ち出し

(12/22) 「中小企業等事業再構築促進事業」における採択者情報の不正持出の疑いについて｜中小機構

(12/22) 「中小企業等事業再構築促進事業」における採択者情報の不正持出の疑いについて


千葉県市原市の職員が行政総合情報システムを不正に閲覧し、知人女性の個人情報を収集

(12/25) 懲戒処分の公表について


攻撃、脅威

警察庁と金融庁がインターネットバンキングの不正送金被害について注意喚起

(12/25) フィッシングによるものとみられるインターネットバンキングに係る不正送金被害の急増について（注意喚起）


Microsoft が App Installer を悪用する攻撃について報告

(12/28) Financially motivated threat actors misusing App Installer | Microsoft Security Blog


脆弱性

Barracuda ESG に新たな脆弱性

(12/24) Barracuda Email Security Gateway Appliance (ESG) Vulnerability

Barracuda has filed CVE-2023-7102 in relation to Barracuda’s use of Spreadsheet::ParseExcel which has been patched. In addition, in order to increase public awareness of the ACE vulnerability in Spreadsheet::ParseExcel, Barracuda has filed CVE-2023-7101. At the time of this update, there is no known patch or update available to remediate CVE-2023-7101 within the open source library. For organizations utilizing Spreadsheet::ParseExcel in their own products or services, we recommend reviewing CVE-2023-7101 and promptly taking necessary remediation measures.


NICT が ASUS ルータの認証情報が漏洩する問題について注意喚起

(12/27) ASUSルータにおける認証情報が漏洩する問題とその対策方法 - NICTER Blog


その他

米国で FISA の Section 702 が来年 4月19日まで暫定延長

(12/22) Biden signs short-term FISA extension before year-end deadline

(12/14) Debate over US surveillance powers pushed into 2024

(参考) Foreign Intelligence Surveillance Act (FISA) and Section 702 — FBI


Ghidra 11.0 がリリース

(12/23) Ghidra


JNSA が2023セキュリティ十大ニュースを発表

(12/26) JNSAセキュリティ十大ニュース

今週の気になるセキュリティニュース - Issue #150

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

イランでサイバー攻撃により多数のガソリンスタンドの販売システムに障害

(12/18) Hacktivists say they shut down Iran's gasoline pumps • The Register

Hacktivists reportedly disrupted services at about 70 percent of Iran's gas stations in a politically motivated cyberattack.

Iran's oil minister Javad Owji confirmed on Monday the IT systems of the nation's petrol stations had been attacked as Iranian media told of long queues at the pumps and traffic jams – particularly in Tehran - as folks tried and failed to fill up.

(12/18) Iran confirms nationwide cyberattack on gas stations

(12/19) イランでガソリンスタンドに大規模サイバー攻撃か | NHK | イラン


多数の法執行機関の協力による半年間に及ぶ作戦 Operation HAECHI IV の結果、34ヶ国で約 3,500人を逮捕し、$300Mの資産を差し押え

(12/19) USD 300 million seized and 3,500 suspects arrested in international financial crime operation

A transcontinental police operation against online financial crime has concluded with almost 3,500 arrests and seizures of USD 300 million (approx. EUR 273 million) worth of assets across 34 countries.

The six-month Operation HAECHI IV (July-December 2023) targeted seven types of cyber-enabled scams: voice phishing, romance scams, online sextortion, investment fraud, money laundering associated with illegal online gambling, business email compromise fraud, and e-commerce fraud.


長野日報でランサムウェア感染被害により新聞製作・発行に影響

(12/22) おわび（サーバーウイルス感染のため特別紙面） – Nagano Nippo Web

12月19日深夜に弊社のサーバーが身代金要求型ウイルス（ランサムウエア）に感染した影響で、新聞製作に及ぼす影響が続いております。このため、22日付本紙も通常よりページ数を減らした特別紙面として発行します。

サーバーには、いずれも公開を前提として紙面に使用する記事と写真データが蓄積されていますが、個人情報の流出はありません。当社のホームページやメールシステムは通常通り稼働しています。


攻撃、脅威

CISA などが共同で、Play ランサムウェアに関する注意喚起

(12/18) #StopRansomware: Play Ransomware | CISA


CISA と FBI が共同で ALPHV Blackcat ランサムウェアに関する注意喚起。また米司法省は Blackcat ランサムウェアのリークサイトを差し押え、被害組織に対して復号ツールを提供

(12/19) #StopRansomware: ALPHV Blackcat | CISA

(12/19) Office of Public Affairs | Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant | United States Department of Justice

The Justice Department announced today a disruption campaign against the Blackcat ransomware group — also known as ALPHV or Noberus — that has targeted the computer networks of more than 1,000 victims and caused harm around the world since its inception, including networks that support U.S. critical infrastructure.

Over the past 18 months, ALPHV/Blackcat has emerged as the second most prolific ransomware-as-a-service variant in the world based on the hundreds of millions of dollars in ransoms paid by victims around the world. Due to the global scale of these crimes, multiple foreign law enforcement agencies are conducting parallel investigations.

The FBI developed a decryption tool that allowed FBI field offices across the country and law enforcement partners around the world to offer over 500 affected victims the capability to restore their systems. To date, the FBI has worked with dozens of victims in the United States and internationally to implement this solution, saving multiple victims from ransom demands totaling approximately $68 million. As detailed in a search warrant unsealed today in the Southern District of Florida, the FBI has also gained visibility into the Blackcat ransomware group’s computer network as part of the investigation and has seized several websites that the group operated.

(12/19) FBI disrupts Blackcat ransomware operation, creates decryption tool

(12/19) How the FBI seized BlackCat (ALPHV) ransomware’s servers


ESET が 2023年下半期の脅威レポート "ESET Threat Report H2 2023" を公開

(12/19) ESET Threat Report H2 2023


IIJ が Mirai 亜種 InfectedSlurs の活動状況について報告

(12/20) Mirai 亜種 InfectedSlurs の活動状況 – IIJ Security Diary

(コメント) 久しぶりに会社ブログの方に記事書きました


消費者庁がショッピングサイトの偽サイトに関する注意喚起

(12/21) 人気ブランドの女性用衣料品等を販売すると称する偽サイトに関する注意喚起 | 消費者庁

令和4年の夏以降、SNS等を見ていると、「ミズノ」又は「ワコール」の商品ブランドロゴを使用した女性用衣料品等に関する広告が表示され、当該広告のリンク先のウェブサイトで商品を注文したところ、これらのブランドの商品ではないものが届いたなどという相談が、各地の消費生活センター等に数多く寄せられています。

消費者庁が調査を行ったところ、上記行為を行う事業者が、消費者の利益を不当に害するおそれのある行為(消費者を欺く行為)を行っていたことを確認したため、消費者安全法(平成21年法律第50号)第38条第1項の規定に基づき、消費者被害の発生又は拡大の防止に資する情報を公表し、消費者の皆様に注意を呼びかけます。


脆弱性

QNAP VioStor NVR に脆弱性。すでに悪用が確認されている。

(12/9) Vulnerability Affecting Legacy VioStor NVR - Security Advisory | QNAP

(12/14) Actively Exploited Vulnerability in QNAP VioStor NVR: Fixed, Patches Available | Akamai

(12/22) JVNVU#96089700: QNAP製VioStor NVRにおけるOSコマンドインジェクションの脆弱性

なお、本件の報告者により本脆弱性を悪用した攻撃が確認されており、またJPCERT/CCにおいても同様の通信を確認しています。


メールの送信元詐称を可能にする SMTP Smuggling 脆弱性。複数の SMTP サーバ実装に影響

(12/18) SMTP Smuggling - Spoofing E-Mails Worldwide - SEC Consult

By exploiting interpretation differences of the SMTP protocol, it is possible to smuggle/send spoofed e-mails - hence SMTP smuggling - while still passing SPF alignment checks. During this research, two types of SMTP smuggling, outbound and inbound, were discovered. These allowed sending spoofed e-mails from millions of domains (e.g., admin@outlook.com) to millions of receiving SMTP servers (e.g., Amazon, PayPal, eBay). Identified vulnerabilities in Microsoft and GMX were quickly fixed, however, SEC Consult urges companies using the also affected Cisco Secure Email product to manually update their vulnerable default configuration (see Responsible Disclosure section below)!

(12/22) SMTP Smuggling

Days before a 10+ day holiday break and associated production change freeze, SEC Consult has published an email spoofing attack that involves a composition of email services with specific differences in the way they handle line endings other than .

Unfortunately, criticial information provided by the researcher was not passed on to Postfix maintainers before publication of the attack, otherwise we would certainly have convinced SEC Consult to change their time schedule until after people had a chance to update their Postfix systems.


SSH のプロトコルに中間者攻撃が可能な脆弱性

(12/19) Terrapin Attack

Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.

(12/19) SSH protects the world’s most sensitive networks. It just got a lot weaker | Ars Technica

(12/19) シーケンス番号操作によるSSH通信の完全性への攻撃


Google が Chrome のゼロデイ脆弱性を修正

(12/20) Chrome Releases: Stable Channel Update for Desktop

Google is aware that an exploit for CVE-2023-7024 exists in the wild.


CISA が Known Exploited Vulnerabilities (KEV) カタログに 2 個の脆弱性を追加

(12/21) CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

  • CVE-2023-49897 FXC AE1021, AE1021PE OS Command Injection Vulnerability
  • CVE-2023-47565 QNAP VioStor NVR OS Command Injection Vulnerability


その他

IPA がサポート詐欺の「偽セキュリティ警告画面の閉じ方体験サイト」を公開

(12/19) サポート詐欺の「偽セキュリティ警告画面の閉じ方体験サイト」を公開 | 情報セキュリティ | IPA 独立行政法人 情報処理推進機構

(12/19) 偽セキュリティ警告（サポート詐欺）対策特集ページ | 情報セキュリティ | IPA 独立行政法人 情報処理推進機構


欧米の10ヶ国が、ウクライナの民間分野でのサイバー能力向上を支援する枠組み「タリン・メカニズム」を創設

(12/20) Tallinn Mechanism | Välisministeerium

Estonia and Canada, Denmark, France, Germany, Netherlands, Poland, Sweden, Ukraine, the United Kingdom and the United States have decided to set up a system aimed at amplifying the cyber support of donors to Ukraine in the civilian domain. The plan composed on 30 May in Tallinn by all participating states was launched on 20 December 2023 and the system was named the Tallinn Mechanism after the location of the initial meeting.

(12/20) Formalization of the Tallinn Mechanism to Coordinate Civilian Cyber Assistance to Ukraine - United States Department of State

(12/20) UK and partners form The Tallinn Mechanism for cyber security - GOV.UK