今週の気になるセキュリティニュース - Issue #189

Revue アレかね

ポッドキャスト収録用のメモですよ。

podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。


事件、事故

Europol が複数の法執行機関と連携し、犯罪者に利用されていた暗号通信プラットフォーム Ghost を摘発

(9/18) Global Coalition Takes Down New Criminal Communication Platform | Europol

Europol and Eurojust, together with law enforcement and judicial authorities from around the world, have successfully dismantled an encrypted communication platform that was established to facilitate serious and organised crime perpetrated by dangerous criminal networks operating on a global scale. The platform, known as Ghost, was used as a tool to carry out a wide range of criminal activities, including large-scale drug trafficking, money laundering, instances of extreme violence and other forms of serious and organised crime.

(9/18) AFP Operation Kraken charges alleged head of global organised crime app | Australian Federal Police


米司法省が中国の攻撃者グループ Flax Typhoon に利用されていたボットネットを摘発

(9/18) Office of Public Affairs | Court-Authorized Operation Disrupts Worldwide Botnet Used by People’s Republic of China State-Sponsored Hackers | United States Department of Justice

The Justice Department today announced a court-authorized law enforcement operation that disrupted a botnet consisting of more than 200,000 consumer devices in the United States and worldwide. As described in court documents unsealed in the Western District of Pennsylvania, the botnet devices were infected by People’s Republic of China (PRC) state-sponsored hackers working for Integrity Technology Group, a company based in Beijing, and known to the private sector as “Flax Typhoon.”

(9/18) Derailing the Raptor Train - Lumen


ドイツの法執行機関が犯罪者による資金洗浄に使われていた 47 の暗号資産取引所を閉鎖

(9/19) BKA - Listenseite für Pressemitteilungen 2024 - Cybercrime: Erfolgreicher Schlag gegen die Infrastruktur von digitalen Geldwäschern der Underground Economy

(9/19) FINAL EXCHANGE


攻撃、脅威

IPA がパソコンの画面全体に偽のメッセージが表示され操作不能になる手口について注意喚起

(9/17) パソコンの画面全体に偽のメッセージが表示され操作不能になる手口が増加中 | 情報セキュリティ | IPA 独立行政法人 情報処理推進機構

2024年6月から、パソコンを使用中に突然、画面全体に偽のメッセージが表示されて、キーボードやマウスの操作を一切受け付けなくなり、電源を入れなおして再起動しても状況が変わらないという相談が寄せられています（本資料ではこの手口を「操作不能の偽メッセージ」と呼称します）。

メッセージには、マイクロソフトサポートへ電話をするように嘘のメッセージがあることから、これまでの「サポート詐欺（別名：偽のセキュリティ警告）」と同様に相談が寄せられていますが、ウェブブラウザに偽の警告を表示していたものとは手口が異なり、これまでのサポート詐欺の手口でご案内した対処が通用しないことが確認されています。


Microsoft がロシアなどによる米大統領選挙への影響工作について報告

(9/17) Russian election interference efforts focus on the Harris-Walz campaign - Microsoft On the Issues


Mandiant が北朝鮮の攻撃者グループ UNC2970 の攻撃活動について報告

(9/18) An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader | Google Cloud Blog


警察庁が「令和６年上半期におけるサイバー空間をめぐる脅威の情勢等について」を公表

(9/19) 令和６年上半期におけるサイバー空間をめぐる脅威の情勢等について｜警察庁Webサイト


Mandiant がイランの攻撃者グループ UNC1860 の攻撃活動について報告

(9/20) UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks | Google Cloud Blog

UNC1860 is a persistent and opportunistic Iranian state-sponsored threat actor that is likely affiliated with Iran’s Ministry of Intelligence and Security (MOIS). A key feature of UNC1860 is its collection of specialized tooling and passive backdoors that Mandiant believes supports several objectives, including its role as a probable initial access provider and its ability to gain persistent access to high-priority networks, such as those in the government and telecommunications space throughout the Middle East.


脆弱性

CISA が Known Exploited Vulnerabilities (KEV) カタログに 2+4+5+1 個の脆弱性を追加

(9/16) CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

(9/17) CISA Adds Four Known Exploited Vulnerabilities to Catalog | CISA

(9/18) CISA Adds Five Known Exploited Vulnerabilities to Catalog | CISA

(9/19) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

  • CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability


Apple が macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, iOS 18 / iPadOS 18, iOS 17.7 / iPadOS 17.7, tvOS 18, watchOS 11, visionOS 2, Safari 18 をリリース

(9/16) Apple security releases - Apple Support


VMware vCenter に複数の脆弱性

(9/17) VMSA-2024-0019:VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-38812, CVE-2024-38813)

(9/17) VMSA-2024-0019: Questions & Answers - VMware Cloud Foundation (VCF) Blog


Ivanti Cloud Service Appliance に新たな脆弱性。先週公開されたパッチで修正済み

(9/19) Security Advisory Ivanti CSA 4.6 (Cloud Services Appliance) (CVE-2024-8963)

Ivanti is disclosing a critical vulnerability in Ivanti CSA 4.6 which was incidentally addressed in the patch released on 10 September (CSA 4.6 Patch 519). Successful exploitation could allow a remote unauthenticated attacker to access restricted functionality.

If CVE-2024-8963 is used in conjunction with CVE-2024-8190 an attacker can bypass admin authentication and execute arbitrary commands on the appliance.


その他

Instagram が未成年のユーザを保護する Teen Accounts 機能を導入

(9/17) Introducing Instagram Teen Accounts: Built-In Protections for Teens, Peace of Mind for Parents | Meta


Discord が Passkeys によるパスワードレスログインを導入し、音声通話とビデオ通話では E2EE をサポート

(9/17) Making your hangouts on Discord more private and secure

(9/17) Meet DAVE: Discord’s New End-to-End Encryption for Audio & Video


NICT が 2024年第 2 四半期の NICTER観測統計を公開

(9/18) NICTER観測統計 - 2024年4月～6月 - NICTER Blog


Google Password Manager が Android に加えて複数のプラットフォームで Passkeys の同期に対応

(9/19) More users can now save passkeys in Google Password Manager

Today, we're rolling out updates that make it even easier to use passkeys across your devices. You can now save passkeys to Google Password Manager from Windows, macOS, Linux and Android, with ChromeOS currently available for testing in Beta. Once they're saved, they'll automatically sync across your devices, making signing in as easy as scanning your fingerprint.

(9/19) Chrome to sync passkeys on Google Password Manager between macOS, Windows , Linux and Android | Blog | Chrome for Developers