今週の気になるセキュリティニュース - Issue #167

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

富士通 Japan の「Fujitsu MICJET コンビニ交付」で再び証明書の誤交付が発生。総務省は富士通に対して行政指導

(4/16) 高松市様における「Fujitsu MICJET コンビニ交付」での証明書の誤交付発生について : 富士通Japan株式会社

2024年4月4日に高松市様において、「Fujitsu MICJET コンビニ交付」で、申請された方とは異なる住民の方の住民票の写しが発行される事象が発生いたしました。高松市様および住民の皆様、関係者の皆様には多大なるご迷惑、ご心配をお掛けしましたことをお詫び申し上げます。

(4/16) 総務省｜報道資料｜コンビニ交付サービスにおける証明書誤交付に関する原因究明及び再発防止対策等の徹底について（指導）

総務省は、本日、富士通株式会社（代表取締役社長　時田 隆仁、法人番号 1020001071491、本社 東京都港区）に対し、同社の子会社である富士通Japan株式会社における、香川県高松市のコンビニ交付において別人の住民票の写しが交付された事案に関し、原因究明及び再発防止対策等の徹底を図るとともに、その実施状況を報告するよう、文書による行政指導を行いました。


LINE ヤフーに対して総務省が再度行政指導

(4/16) 総務省｜報道資料｜LINEヤフー株式会社に対する通信の秘密の保護及び サイバーセキュリティの確保の徹底に向けた措置（指導）

総務省は、LINEヤフー株式会社（代表取締役社長CEO 出澤 剛）に対し令和6年3月5日付けで行政指導を実施し、同年4月1日、同社から再発防止等に向けた取組に関する報告書の提出を受けました。同報告書を踏まえ、総務省は、同行政指導において求めた措置の早期実施等を求めるとともに、その実施状況や実施計画を報告するよう、本日、文書による行政指導を行いました。

(4/16) 当社に対する総務省からの行政指導について｜LINEヤフー株式会社


欧米の法執行機関の協力により、phishing-as-a-service のプラットフォーム LabHost を摘発

(4/18) International investigation disrupts phishing-as-a-service platform LabHost | Europol

This week, law enforcement from 19 countries severely disrupted one of the world’s largest phishing-as-a-service platform, known as LabHost. This year-long operation, coordinated at the international level by Europol, resulted in the compromise of LabHost’s infrastructure.

(4/18) Law enforcement infiltrates fraud platform used by thousands of criminals worldwide | Metropolitan Police

(4/18) The Fall of LabHost: Law Enforcement Shuts Down Phishing Service Provider | Trend Micro (US)


MITRE が外部からの不正侵入を受けたことを公表

(4/19) MITRE Response to Cyber Attack in One of Its R&D Networks | MITRE

MITRE today disclosed that despite its fervent commitment to safeguarding its digital assets, it experienced a breach that underscores the nature of modern cyber threats. After detecting suspicious activity on its Networked Experimentation, Research, and Virtualization Environment (NERVE), a collaborative network used for research, development, and prototyping, compromise by a foreign nation-state threat actor was confirmed.

(4/19) Advanced Cyber Threats Impact Even the Most Prepared | by Lex Crumpton | MITRE-Engenuity | Apr, 2024 | Medium

Starting in January 2024, a threat actor performed reconnaissance of our networks, exploited one of our Virtual Private Networks (VPNs) through two Ivanti Connect Secure zero-day vulnerabilities, and skirted past our multi-factor authentication using session hijacking. From there, they moved laterally and dug deep into our network’s VMware infrastructure using a compromised administrator account. They employed a combination of sophisticated backdoors and webshells to maintain persistence and harvest credentials.

MITRE followed best practices, vendor instructions, and the government’s advice to upgrade, replace, and harden our Ivanti system, but we did not detect the lateral movement into our VMware infrastructure. At the time we believed we took all the necessary actions to mitigate the vulnerability, but these actions were clearly insufficient.


攻撃、脅威

Cloudflare が 2024年第 1四半期の DDoS 攻撃レポートを公開

(4/16) DDoS threat report for 2024 Q1

Key insights from the first quarter of 2024 include:

  • 2024 started with a bang. Cloudflare’s defense systems automatically mitigated 4.5 million DDoS attacks during the first quarter — representing a 50% year-over-year (YoY) increase.
  • DNS-based DDoS attacks increased by 80% YoY and remain the most prominent attack vector.
  • DDoS attacks on Sweden surged by 466% after its acceptance to the NATO alliance, mirroring the pattern observed during Finland's NATO accession in 2023.


Coveware が 2024年第 1四半期のランサムウェアレポートを公開

(4/17) RaaS devs hurt their credibility by cheating affiliates in Q1 2024


Mandiant が攻撃者グループ APT44 (Sandworm) の活動について報告

(4/18) Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm | Google Cloud Blog

Given the active and diffuse nature of the threat posed by Sandworm globally, Mandiant has decided to graduate the group into a named Advanced Persistent Threat: APT44. As part of this process, we are releasing a report, “APT44: Unearthing Sandworm”, that provides additional insights into the group’s new operations, retrospective insights, and context on how the group is adjusting to support Moscow’s war aims.


CISA が Akira ランサムウェアに関する注意喚起

(4/18) #StopRansomware: Akira Ransomware | CISA


脆弱性

PuTTY に秘密鍵が復元できる脆弱性

(4/15) oss-security - CVE-2024-31497: Secret Key Recovery of NIST P-521 Private Keys Through Biased ECDSA Nonces in PuTTY Client

The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. To be more precise, the first 9 bits of each ECDSA nonce are zero. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (man-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents. The nonce generation for other curves is slightly biased as well. However, the bias is negligible and far from enough to perform lattice-based key recovery attacks (not considering cryptanalytical advancements).

(4/16) 「PuTTY」に秘密鍵が復元できてしまう深刻な脆弱性 ～「WinSCP」など他ツールにも影響 - 窓の杜


PAN-OS の脆弱性 CVE-2024-3400 の PoC が公開され、悪用が拡大

(4/16) Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400)

(4/17) CVE-2024-3400 | AttackerKB

(4/17 更新) CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect

Palo Alto Networks is aware of an increasing number of attacks that leverage the exploitation of this vulnerability. Proof of concepts for this vulnerability have been publicly disclosed by third parties.

(4/19) More on the PAN-OS CVE-2024-3400

(参考) PAN-OS GlobalProtect の脆弱性 CVE-2024-3400 についてまとめてみた - piyolog


その他

CISA、FBI ほか Five Eyes が共同で、AI システムの安全な導入および運用に関するガイダンスを公開

(4/15) Joint Guidance on Deploying AI Systems Securely | CISA

The guidance provides best practices for deploying and operating externally developed artificial intelligence (AI) systems and aims to:

  • Improve the confidentiality, integrity, and availability of AI systems.
  • Ensure there are appropriate mitigations for known vulnerabilities in AI systems.
  • Provide methodologies and controls to protect, detect, and respond to malicious activity against AI systems and related data and services.


Bitcoin が 4回目の半減期に到達

(4/20) ビットコイン、4度目の半減期完了 報酬が3.125 BTCに

(4/20) ビットコイン 4回目の半減期を成功裏に完了 ｜ 「25万ドルにまで上昇する」との強気予測も | Cointelegraph | コインテレグラフ ジャパン