今週の気になるセキュリティニュース - Issue #182

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

フランス各地で複数の通信事業者の光ファイバーが切断される

(7/29) French telecom infrastructure damaged in another sabotage attack

(7/29) Saboteurs Cut Internet Cables in Latest Disruption During Paris Olympics | WIRED

(7/29) フランス６県で光ファイバーケーブル切断される…パリへの通信接続や五輪運営には支障なし : 読売新聞


DigiCert が証明書発行時の不備により、多数の証明書を失効処理

(7/29) Certificate Revocation Incident | DigiCert

(7/30) DigiCert Status - DigiCert Revocation Incident (CNAME-Based Domain Validation)


攻撃、脅威

Microsoft が VMware ESXi の脆弱性 CVE-2024-37085 を悪用するランサムウェアの活動について報告

(7/29) Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption | Microsoft Security Blog

The vulnerability, identified as CVE-2024-37085, involves a domain group whose members are granted full administrative access to the ESXi hypervisor by default without proper validation. Microsoft disclosed the findings to VMware through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR), and VMWare released a security update. Microsoft recommends ESXi server administrators to apply the updates released by VMware to protect their servers from related attacks, and to follow the mitigation and protection guidance we provide in this blog post. We thank VMWare for their collaboration in addressing this issue.

(7/29) CVE-2024-37085 | AttackerKB

(7/30) VMware ESXi CVE-2024-37085 Targeted in Ransomware Campaigns | Rapid7 Blog


M365 から Proofpoint のサービスを経由して大量のフィッシングメールを送信する攻撃キャンペーンが確認される

(7/29) Scammer Abuses Microsoft 365 Tenants, Relaying Through Proofpoint Servers to Deliver Spam Campaigns | Proofpoint US

The root cause is a modifiable email routing configuration feature on Proofpoint servers to allow relay of organizations’ outbound messages from Microsoft 365 tenants, but without specifying which M365 tenants to allow

(7/30) “EchoSpoofing” — A Massive Phishing Campaign Exploiting Proofpoint’s Email Protection to Dispatch Millions of Perfectly Spoofed Emails | by Guardio | Jul, 2024 | Medium

Guardio Labs has uncovered a critical in-the-wild exploit of Proofpoint’s email protection service, responsible for securing 87 of the Fortune 100 companies. Dubbed “EchoSpoofing”, this issue allowed threat actors to dispatch millions of perfectly spoofed phishing emails, leveraging Proofpoint’s customer base of well-known companies and brands such as Disney, IBM, Nike, Best Buy, and Coca-Cola. These emails echoed from official Proofpoint email relays with authenticated SPF and DKIM signatures, thus bypassing major security protections — all to deceive recipients and steal funds and credit card details.

(7/30) VU#244112 - Multiple SMTP services are susceptible to spoofing attacks due to insufficient enforcement


Mandiant が攻撃者グループ UNC4393 の攻撃活動について報告

(7/30) UNC4393 Goes Gently into the SILENTNIGHT | Google Cloud Blog


Coveware が 2024年第 2四半期のランサムウェアレポートを公開

(7/30) Ransomware actors pivot away from major brands in Q2 2024

In the second quarter of 2024, we observed a large increase in attacks that appeared to have unaffiliated branding attribution. Branding attribution includes aspects of the attack that bind the attacker to a specific brand of ransomware (e.g., Lockbit, Black Basta). The attributes are typically obvious indicators of compromise (IOCs) such as the type of encryption malware (which is brand-specific most of the time), the accompanying ransom note (which identifies the brand of ransomware), or a branded TOR site used for victims/threat actor communications. Over 10% of the incidents handled by Coveware in Q2 were unaffiliated; this is attributed to attackers that were deliberately operating independently of a specific brand and what we typically term ‘lone wolves'. We have seen small jumps in unaffiliated ransomware attacks before, but never to such magnitude, so it’s worth discussing why and how this happens.


IBM が Cost of a Data Breach Report 2024 を公開

(7/30) Surging data breach disruption drives costs to record highs

Security teams are getting better at detecting and responding to breach incursions, but attackers are inflicting greater pain on organizations’ bottom lines. IBM’s recent Cost of a Data Breach Report 2024 found the global average breach hit a record $4.88 million. That’s a 10% increase from 2023 and the largest spike since the pandemic.


IPA がサポート詐欺レポートを公開

(7/31) サポート詐欺レポート | 情報セキュリティ | IPA 独立行政法人 情報処理推進機構


Cisco Talos が攻撃者グループ APT41 の攻撃活動について報告

(8/1) APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike


脆弱性

SKYSEA Client View に複数の脆弱性

(7/29) 【重要】特定プロセスにおけるアクセス制限不備の脆弱性（CVE-2024-41139） / 共有メモリを介したデータ交換におけるリクエスト発信元の検証欠如の脆弱性（CVE-2024-41143） / パストラバーサルの脆弱性（CVE-2024-41726）｜SKYSEA Client View

(7/29) JVN#84326763: SKYSEA Client Viewにおける複数の脆弱性


CISA が Known Exploited Vulnerabilities (KEV) カタログに 3+1 個の脆弱性を追加

(7/29) CISA Adds Three Known Exploited Vulnerabilities to Catalog | CISA

  • CVE-2024-4879 ServiceNow Improper Input Validation Vulnerability
  • CVE-2024-5217 ServiceNow Incomplete List of Disallowed Inputs Vulnerability
  • CVE-2023-45249 Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

(7/30) CISA Adds One Known Exploited Vulnerability to Catalog | CISA


Apple が macOS Monterey 12.7.6, macOS Ventura 13.6.8, macOS Sonoma 14.6, iOS 16.7.9 / iPadOS 16.7.9, iOS 17.6 / iPadOS 17.6, tvOS 17.6, watchOS 10.6, visionOS 1.3, Safari 17.6 をリリース

(7/29) Apple security releases - Apple Support


その他

Apple が衛星経由の緊急SOS サービスを日本でも提供開始

(7/30) 衛星経由の緊急SOS、本日提供開始 - Apple (日本)