If It’s Easy, It’s TZ

“Grow by leveraging the web” is today’s SMB rally call. But it is the echo to that call that you need to pay attention to – as you open the internet door wider, you are also opening the door to more cyber-attacks. Protection does not have to break the bank or keep you up at night. The SonicWall TZ Series of firewalls is designed specifically for the needs of SMBs and branch locations, delivering enterprise-class security without enterprise-grade complexity. With the new SonicWall TZ Series firewalls, you can get a better firewall that performs at faster broadband speeds for a low total cost of ownership.

Image featuring the product line of TZ firewall series, advanced security solutions for SMBs.

What is TZ?

The TZ Series is the entry-level firewall series offered by SonicWall and it stands for Trusted Zones – it’s also the firewall of choice for most of the Managed Serviced Providers (MSPs). If it’s easy, it’s TZ – easy to use, easy to afford and easy to love. Users can simply plug it in and enjoy the advanced protection of the cost-effective SonicWall TZ Series firewalls without worrying about complex management — or the next threat.

The SonicWall TZ Series is Better

There is no reason why your firewall should not have the same protections that big businesses demand. The thinking behind all our network security products is to not cut corners when it comes to inspecting traffic. We inspect the whole file – no limits on the file size or on the ports and protocols being used. The new TZ Series offers 1/2.5/5/10 GbE network interfaces and gives you the type of protection that big businesses, large universities and government agencies enjoy. You can impress your big business partners with enterprise-grade protection featuring Advanced Malware Protection, Anti-Malware, Intrusion Prevention Services (IPS), Content Filtering Services (CFS) and URL Filtering, Application Control, and Secure Mobile Access (SMA).

The SonicWall TZ Series is Faster

Faster broadband is the starting point, but you also want faster wireless. To accomplish this, your firewall needs a lot of horsepower. The SonicWall TZ Series has plenty. Designed with the knowledge of the exploding growth in SSL use, the TZ Series has the horsepower to identify malware lurking in encrypted SSL traffic. With an integrated wireless controller, the business does not require additional costs to offer their customers and employees the extreme speeds that a wireless device can deliver.

The SonicWall TZ Series is Affordable

In the past, to meet high-speed broadband requirements, business owners would have to pay a hefty price. The SonicWall TZ 370 firewall can deliver full Deep Packet Protection at 1 Gbps speed for an affordable price (the TotalSecure bundle includes the appliance, CFS, Application Control, IPS, Advanced Malware Protection, SSL Inspection, and Gateway Antivirus).

The SonicWall TZ Series is the Solution for SMBs

Don’t let cybercriminals compromise your organization. The SonicWall TZ Series can meet your performance and security requirements at a price that doesn’t break the bank. For more information, take a look at the SonicWall TZ Series Data Sheet that gives you all the details on this great new product. The TZ Series product line provides all of our security services à la carte and as part of our Security Services Bundles.

Cybersecurity News & Trends – 07-14-2023

It’s mid-July and things are heating up at SonicWall. This week Silicon Republic spoke with SonicWall’s own Vice President of EMEA, Spencer Starkey, about hackers targeting the healthcare sector across the globe.

In industry news, Data Breach Today covers the largest data breach of the year. Dark Reading discusses cybersecurity organizations asking the White House to quickly name a new director. TechCrunch has the lowdown on China-based hackers accessing US government emails. Hacker News provides details on more Google Play apps stealing user data.

Remember to keep your passwords close and your eyes peeled – cybersecurity is everyone’s responsibility.

SonicWall News

Hackers claim breach is the ‘biggest ever’ in NHS history

Silicon Republic, SonicWall News: Spencer Starkey, vice-president of EMEA at cybersecurity company SonicWall, said that the healthcare sector continues to be a “prime target” for hackers globally. “Not only does this attack risk the potential for exposed patient data, but any significant IT issue that halts patient care poses an immediate threat to life,” said Starkey, referring to the Barts Health cyberattack. The ramifications of an attack on the healthcare sector can be disastrous and it’s important to place the utmost amount of time, money and efforts on securing it.

How to Reach Compliance with HIPAA

TrendMicro, SonicWall News: According to the 2022 SonicWall Cyber Threat Report, healthcare continued a large spike in malware in 2021, at 121%. While the largest jump in IoT malware attacks belonged to healthcare, which saw a 71% year-over-year increase. To shed light on the significance malware can carry, it’s important to look at how recent breaches could’ve been circumvented by abiding to the HIPAA rules and safeguards.

Why Attackers Love to Target IoT Devices

VentureBeat, SonicWall News: Malicious objects were blocked on more than 40% of OT systems. SonicWall Capture Labs threat researchers recorded 112.3 million instances of IoT malware in 2022, an 87% increase over 2021.

Changes in the Ransomware Threat to State and Local Governments

StateTech, SonicWall News: According to SonicWall’s 2023 Cyber Threat Report, ransomware has “been on a tear” for the past few years, growing 105 percent year over year in 2021. While the report found that attacks were down in 2022, ransomware targets still reported very large number of attacks compared to levels in 2018, 2019 and 2020.

Clop’s MOVEit ransom deadline expires

ComputerWeekly, SonicWall News: At the time of writing, no data had yet been published, and SonicWall EMEA vice-president Spencer Starkey urged victims to hold the line in the face of the gang’s threats and grandstanding.

As the clock ticks closer, businesses impacted by the MOVEit hack may be tempted to pay off the hackers and move on. While this appears as the fastest way to resolve this, in fact, it actually feeds the monster, encouraging more attacks, said Starkey. On the other hand, not paying might lead to potential data loss and the cost of restoring systems, but it also helps starve these criminal operations and may discourage future attacks. At this stage, the key is customer and employee communication. The companies impacted must always strive to keep those channels flowing both ways, to reassure those who may be affected that they are doing everything possible to recover from and resolve the incident.

How Healthcare Organizations Are Looking at the Big Picture of Device Security

Health Tech, SonicWall News: Healthcare was the second most targeted industry for malware last year, according to SonicWall’s 2023 Cyber Threat Report. Internet of Things (IoT) malware attacks in healthcare increased 33 percent.

The Capita data breach explained

Verdict, SonicWall News: Immanuel Chavoya from SonicWall told Verdict the recent data breach happened due to an exposed “Amazon S3 bucket”.

Chavoya explains that they are able to be “accessed, altered, or even deleted by anyone who knows where to look and that breaks the core tenants of confidentiality integrity, and availability. However, sometimes, in the process of configuring a bucket, someone might unintentionally set the permissions to allow public access,” Chavoya said.

“For example, they might be trying to make it easier for a team to share files, or they might not realize the implications of making a bucket public,” Chavoya explained. “Unfortunately if sensitive data is stored in the bucket – which it was in this case, this can lead to a data breach. Therefore, it’s crucial to properly configure S3 bucket permissions and regularly review them to ensure they are still appropriately configured.”

How Generative AI Will Remake Cybersecurity

eSecurity Planet, SonicWall News: There are the potential data privacy concerns arising due to the collection and storage of sensitive data by these models,” said Peter Burke, who is the Chief Product Officer at SonicWall. Those concerns have caused companies like JPMorgan, Citi, Wells Fargo and Samsung to ban or limit the use of LLMs. There are also some major technical challenges limiting LLM use.

“Another factor to consider is the requirement for robust network connectivity, which might pose a challenge for remote or mobile devices,” said Burke. “Besides, there may be compatibility issues with legacy systems that need to be addressed. Additionally, these technologies may require ongoing maintenance to ensure optimal performance and protection against emerging threats.”

Companies Turn to Behavior-Based Cybersecurity Training to Stem Tide of Security Breaches

CIO Influence, SonicWall News: According to Glair, a company will never be able to train every person to spot every threat. That comes down to the sheer volume of novel threats being created. In fact, in the first half of 2022, SonicWall detected 270,228 never-before-seen malware variants. That’s an average of 1,500 new variants per day.

U.S.-South Korea Forge Strategic Cybersecurity Framework

Security Boulevard, SonicWall News: Immanuel Chavoya, SonicWall’s emerging threat expert, noted that the accord ushered in a new approach to cybersecurity that is based on cooperation and information sharing. “The introduction of a U.S./South Korea ‘Strategic Cybersecurity Cooperation Framework’ fundamentally alters the global cybersecurity landscape. It exemplifies a shift from siloed defenses to collective global security, fortifying the digital ecosystem against threats by pooling resources, intelligence and expertise,” Chavoya said. “This sends a message to nation-state actors like DPRK: The world’s cyberdefenders are uniting against threat actors who leverage our digital interconnectedness to disrupt our daily lives, making every digital interaction a new front line in this asymmetric war. As we often say, the best offense is a good defense—and in this case, it’s a defense extending traditional alliances across continents and cyberspace alike.”

Cyber Insurers May Want To Rethink Ransom Payments Based On This New Data

CRN, SonicWall News: In many cases, these “extortion-only” attacks are a more lucrative and easier alternative to the process of encryption and negotiation that’s involved in a typical ransomware attack, CrowdStrike’s threat intelligence head told CRN recently. SonicWall, meanwhile, cited extortion-only groups including Lapsus$ and Karakurt as further evidence of the trend.

Cryptomining group traced to Indonesia uses compromised AWS accounts

The Record, SonicWall News: Despite falling digital asset prices, cryptojacking reached record levels in 2022, according to research from cybersecurity firm SonicWall.

Industry News

11 million Patients Affected by HCA Healthcare Email Hack

A large healthcare system was hit by a cyber-attack that resulted in the loss of 11 million patients’ data. HCA Healthcare, number 62 on Forbes’ list of largest corporations by revenue, confirmed the incident this week but noted that its investigation is ongoing. If the number 11 million is accurate, that makes this incident the largest reported incident of the year – by far. According to the statement the Tennessee-based healthcare chain provided to the U.S. Securities and Exchange Commission, it appears that HCA did not know it had been attacked until information on 11 million of its patients was found for sale on the dark web. The exposed list has 27 million rows of exposed information. HCA did note that they’re working as quickly as possible to determine exactly which patients have been compromised by this ordeal. While plenty of sensitive information was exposed in this attack, HCA says that credit card numbers, account numbers, driver’s license numbers, Social Security Numbers and passwords were not revealed. Information on patients’ conditions, diagnoses and treatment plans were also untouched. But fret not – HCA assured its investors that its finances would be fine. They didn’t say much to reassure the 11 million everyday people whose information is now for sale on the dark web. HCA’s revenue was $60 billion last year.

Cybersecurity Orgs Urge White House to Hasten Selection of New National Cyber Director

The Cybersecurity Coalition – a group of prominent cybersecurity organizations – has sent a letter to the White House urging President Biden to promptly select a new National Cyber Director. The letter requests that the President select a new director by the end of this month, citing the complex and shifting threat landscape as a reason for the urgency. The nominee will have to be sent to the Senate for approval regardless of how quickly President Biden and his team select a candidate. The former National Cyber Director, Chris Inglis, retired in February after working in federal agencies for nearly 30 years. The lengthy delay in replacing Inglis has the coalition concerned that Inglis’ work, including on the National Cyber Strategy, could be impeded if the nomination is further delayed. The letter also requested an executive order to clarify the roles and responsibilities of organizations like the ONCD, NSC, CISA, OMB, NIST and more. According to Dark Reading, the United States’ critical infrastructure is still woefully unprepared for ransomware attacks even two years after the Colonial Pipeline attacks. One wonders when cybersecurity will become more of a priority for our leaders.

Microsoft Cloud Bug Allows Chinese Hackers to Access US Emails

A hacking group dubbed “Storm-0558” accessed 25 United States Government email accounts after exploiting a bug in Microsoft’s cloud email service. TechCrunch confirmed that U.S. government agencies were affected after speaking with someone in the White House’s National Security Council. Microsoft described Storm-0558 as a China-based hacking group that has many resources. The tech giant went on to explain that the threat actors forged tokens to access Outlook Web Access (OWA) and gained access to the email accounts by exploiting a token validation issue. Microsoft believes that the hackers were focused on espionage. CISA released an advisory on the situation where they noted that the hackers accessed unclassified email data. CISA also determined that the threat group is a “government-backed” gang, but they did not yet name China as the likely backer.

Google Play Apps with 2.5 million Users Sending Data to China

Two file management Android apps have been secretly stealing user data and sending it to China. An app called File Recovery and Data Recovery with more than 1 million installs and another named File Manager with over 500 thousand installs have been exposed by security researchers as malicious. The apps are developed by the same group. Security researchers at Pradeo found that the apps’ claims that no data is collected are false. The apps steal contact lists, images, audio files, videos, locations and more and send that data back to China. The apps’ developers have also employed shady tactics to prevent users from being able to easily uninstall the apps such as hiding the icons on the home screen. This is yet another reason why it’s important for users to read use agreements before installing apps.

SonicWall Blog

Sonic Boom: Getting to Know the New SonicWall – Michelle Ragusa-McBain

SonicWall’s Traci McCulley Orr Honored as a Talent100 Leader – Bret Fitzgerald

3 & Free Promotion: How to Upgrade to a Gen 7 NSsp Firewall for Free – Michelle Ragusa-McBain

Monthly Firewall Services Option for Simplicity and Scalability – Sorosh Faqiri

Monitoring and Controlling Internet Usage with Productivity Reports – Ashutosh Maheshwari

SonicWall NSM 2.3.5 Brings Enhanced Alerting Capabilities – Suriti Singh

Is Red/Blue Teaming Right for Your Network? – Stephan Kaiser

NSv Series and Microsoft Azure’s Government Cloud: Strengthening Cloud Security – Tiju Cherian

Four SonicWall Employees Featured on CRN’s 2023 Women of the Channel List – Bret Fitzgerald

NSv Series and AWS GovCloud: Facilitating Government’s Move to the Cloud – Tiju Cherian

Sonic Boom: Getting to Know the New SonicWall

In the months after I graduated college, I wasn’t yet sure what I wanted to do next. After attempts to join both the military and the Peace Corps fell through, the possibilities stretched endlessly before me — seemingly in all directions. Hoping to make some connections, I ended up at an alumni event, where another attendee was asking the usual questions about my major.

“Global business and marketing,” I told him. “But I don’t know what I want to do yet.”

“Can you sell me a router?” he asked.

“I don’t know what a router is,” I replied. “But if you teach me, I’ll sell you three of them.”

That man turned out to be the area VP at a major technology company — and that conversation marked the start of a networking and cybersecurity career that would span 18 years and counting.

During this time, I’ve worked with partners of all stripes, leading, developing and growing channel ecosystems at Cisco, Office Depot/CompuCom, JS Group and Cisco again. While working in the channel, I’ve also become increasingly involved with driving Diversity, Equity and Inclusion (DE&I) initiatives and developing the next generation of channel talent.

So, when the opportunity arose to become the new North America Channel Chief for SonicWall, it seemed like a natural next step. SonicWall has long been committed to greater inclusivity and is currently shifting to a more outside-in channel approach. Combined with the company’s recent tremendous growth, I firmly believe there’s never been a more exciting time to be a part of SonicWall — or to partner with SonicWall.

We’re going in a great new direction, but what a lot of people don’t realize is that we’ve already come so far. Now that you’ve gotten to know a little about me, I’d like to be among the first to introduce you to the new SonicWall.

We are not owned by Dell.

I’m a little surprised we still hear this. At this point, we’ve been spun off from Dell for longer than we were part of them (SonicWall was acquired by Dell in 2012, and became its own company in 2016). If anything, it’s a testament to the amazing brand recognition the Dell name gave SonicWall at the time.

But while there are benefits to being under a big brand, there can also be drawbacks. When we became a private entity again seven years ago, that transition offered us a chance to adjust our corporate roadmap and decide what we wanted the next era of SonicWall to look like. As an independent company, SonicWall has been able to act even more quickly in serving and strengthening relationships with our channel partners and customers.

We’re not just firewalls.

Another thing that emerged from this new direction is the expansion of our product portfolio. The recent investments in people, processes and technology have allowed us to move beyond our core offering of firewalls and reimagine SonicWall in a way that would not previously have been possible.

Today, we offer a full suite of solutions designed to stop targeted cyberattacks, including physical firewalls supporting deployments of all sizes, virtual firewalls, endpoint protection, email and application security, zero-trust network access, wireless security, remote workforce security, distributed network security, and more.

We’re not new to the game.

During the past few years, SonicWall has grown tremendously in every market we serve — and at the same time, our actionable threat intelligence has made us a recognized thought leader in the cybersecurity space. While this energy is typically associated with startups and new companies, in reality SonicWall has been serving the cybersecurity market for more than three decades.

But our status as a highly established brand doesn’t mean we’re “legacy,” mothballed or moribund. The past three decades have brought near-constant change — and each of these events has offered us the opportunity to stop and say, “Who does SonicWall want to be now? And what can we do today, that maybe we couldn’t do five years ago or five months ago, to work toward that vision?”

The result is a company that has 30 years of threat intelligence combined with a very entrepreneurial mindset. We have passion, energy and grit to propel us forward, but we have history, reputation and expertise underpinning and enriching this momentum.

The recent supply-chain challenges we saw arise due to the COVID-19 pandemic are a good example of this. While other companies were running waitlists and backorders, SonicWall was consistently able to deliver 95% of orders in three days or less — despite being amid a period of unprecedented growth.

If we hadn’t been both experienced enough to see these changes coming, and agile enough to get ahead of them, we wouldn’t have been able to deliver for our customers and partners when very few others could.

This sweet spot also positions us well for future growth: We’ve been around awhile, but we’re also in a place where we can be creative and innovative. We can build on our past, but we aren’t beholden to it.

We aren’t just in the SMB space.

After heading up the small-business advisory council at Cisco and working to translate their offerings to MSPs, it felt natural to join a company looking to grow their MSP and MSSP offerings, particularly one that caters to SMBs (small and medium-sized businesses) as well as global enterprises.

Unlike many other cybersecurity companies, however, we don’t see this as an either/or proposition. At SonicWall, our goal isn’t just to be a cybersecurity vendor. We will continue to be a big player in the SMB market, but we also want to be a strategic partner that creates the solutions and programs you need to grow your business at any size.

In this way, our continued expansion into the enterprise market doesn’t just benefit enterprise customers. It benefits our SMB customers as well: If we have an existing relationship with an SMB customer, that relationship can continue as their business grows.

It benefits our partners, too: As growing businesses continue their journey with SonicWall, this gives our partners access to bigger deals, boosting their businesses as well. We all help one another grow, and we all benefit from this growth.

We don’t sell to end organizations.

As a 100% channel-driven company, our partner community isn’t just important to us — it’s our lifeblood. Our 17,000 partners (more than 9,000 in North America alone) are the extension of SonicWall’s mission. They’re the trusted advisors to our customers, and we’re working hard to ensure they’re supported.

Increased responsiveness and agility are steps to this goal, but the biggest one is collaboration. Rather than operating in a vacuum and telling partners and customers what we think they need, we want to hear from you.

We may know what the threat landscape looks like, but what does this mean for you specifically? How can we incorporate the right programs, products, solutions, incentives, education, training, enablement — all of it — to make sure you have what you need to be successful and protect your customers?

Our outside-in approach starts with CEO Bob VanKirk and flows down through every employee, in every department, in every country. It’s built around acknowledging the work our partners put in and understanding your needs and pain points. Your work has made our success possible. We couldn’t be more grateful for that, and it’s our goal to continue working to better support and enable you across every function and team.

SonicWall isn’t just another cybersecurity vendor.

I know every company says this, but I truly believe it. What differentiates us from the other 4,327 security companies in the world is that we have the best combination of incredibly great products, at a reasonable price, with wonderful support. Even before I worked here, I was struck by the love that people have for SonicWall. I think a big part of that is the amount of care that we have for our partners and customers. SonicWall has heart.

We frequently hear about experiences at other vendors where people couldn’t find anyone to support them or talk with them about issues because everybody was too busy swimming upstream. But they didn’t feel insignificant at SonicWall. We make the time to offer great service to small and large organizations alike, and our leadership is accessible and wants to help. I’ve been known to give out my email address and personal cell on LinkedIn, because it’s important for me to make sure that everyone has some point of connection. If you have a problem and haven’t heard from anybody, let me know!

None of this means we’re perfect, of course — but when we do get it wrong, we want to make it right. My very first day on the job, I was approached by a partner who said, “Congratulations on your new role. Unfortunately, I’m moving to [a competitor].”

After learning that it was a support issue, we immediately organized a meeting with him, his boss, his support team, myself, and our sales and product folks. We apologized for their trouble, we asked what we could do to help, and then … we just listened. By the end of the call, they had not only chosen to stay with SonicWall, they had also joined our Partner Advisory Council (PAC) so that they could keep giving input and stay involved.

While we were thrilled to keep them as a partner, my favorite part of that story is how we came together to demonstrate that we really cared. We offer quality solutions at a reasonable price, but we recognize that people don’t buy on solutions alone. People buy from those they like, know and trust.

And this goes double when choosing partners. We want to help you reimagine the future of SonicWall with us working alongside you. In the coming months, you’ll be hearing about some new and exciting changes to SonicWall’s partner vision. These changes represent the next step toward continuing to support you as we work together toward an even more successful 2024 and beyond.

Microsoft Security Bulletin Coverage for July 2023

SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of July 2023. A list of issues reported, along with SonicWall coverage information, is as follows:

CVE-2023-32046 Windows MSHTML Platform Elevation of Privilege Vulnerability
IPS 19225: Windows MSHTML Platform Elevation of Privilege (CVE-2023-32046) 1
IPS 19226: Windows MSHTML Platform Elevation of Privilege (CVE-2023-32046) 2

CVE-2023-33134 Microsoft SharePoint Server Remote Code Execution Vulnerability
IPS 3941 : Microsoft SharePoint Server Remote Code Execution (CVE-2023-33134)

CVE-2023-33157 Microsoft SharePoint Remote Code Execution Vulnerability
IPS 3943 : Microsoft SharePoint Remote Code Execution (CVE-2023-33157)

CVE-2023-35311 Microsoft Outlook Security Feature Bypass Vulnerability
ASPY 461 : Exploit-exe exe.MP_330

CVE-2023-36874 Windows Error Reporting Service Elevation of Privilege Vulnerability
ASPY 462 : Exploit-exe exe.MP_331

CVE-2023-36884 Office and Windows HTML Remote Code Execution Vulnerability
ASPY 463 : Malformed-rtf rtf.MP_34

The following vulnerabilities do not have exploits in the wild :
CVE-2023-21526 Windows Netlogon Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-21756 Windows Win32k Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-29347 Windows Admin Center Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2023-32033 Microsoft Failover Cluster Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-32034 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-32035 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-32037 Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-32038 Microsoft ODBC Driver Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-32039 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-32040 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-32041 Windows Update Orchestrator Service Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-32042 OLE Automation Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-32043 Windows Remote Desktop Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-32044 Microsoft Message Queuing Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-32045 Microsoft Message Queuing Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-32047 Paint 3D Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-32049 Windows SmartScreen Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-32050 Windows Installer Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-32051 Raw Image Extension Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-32052 Microsoft Power Apps Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2023-32053 Windows Installer Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-32054 Volume Shadow Copy Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-32055 Active Template Library Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-32056 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-32057 Microsoft Message Queuing Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-32083 Microsoft Failover Cluster Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-32084 HTTP.sys Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-32085 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-33127 .NET and Visual Studio Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-33148 Microsoft Office Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-33149 Microsoft Office Graphics Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-33150 Microsoft Office Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-33151 Microsoft Outlook Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2023-33152 Microsoft ActiveX Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-33153 Microsoft Outlook Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-33154 Windows Partition Management Driver Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-33155 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-33156 Microsoft Defender Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-33158 Microsoft Excel Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-33159 Microsoft SharePoint Server Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2023-33160 Microsoft SharePoint Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-33161 Microsoft Excel Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-33162 Microsoft Excel Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-33163 Windows Network Load Balancing Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-33164 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-33165 Microsoft SharePoint Server Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-33166 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-33167 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-33168 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-33169 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-33170 ASP.NET and Visual Studio Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-33171 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
There are no known exploits in the wild.
CVE-2023-33172 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-33173 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-33174 Windows Cryptographic Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35296 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35297 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35298 HTTP.sys Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35299 Windows Common Log File System Driver Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35300 Remote Procedure Call Runtime Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35302 Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35303 USB Audio Class System Driver Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35304 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35305 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35306 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35308 Windows MSHTML Platform Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-35309 Microsoft Message Queuing Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35310 Windows DNS Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35312 Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35313 Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35314 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35315 Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35316 Remote Procedure Call Runtime Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35317 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35318 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35319 Remote Procedure Call Runtime Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35320 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35321 Windows Deployment Services Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35322 Windows Deployment Services Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35323 Windows OLE Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35324 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35325 Windows Print Spooler Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35326 Windows CDP User Components Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35328 Windows Transaction Manager Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35329 Windows Authentication Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35330 Windows Extended Negotiation Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35331 Windows Local Security Authority (LSA) Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35332 Windows Remote Desktop Protocol Security Feature Bypass
There are no known exploits in the wild.
CVE-2023-35333 MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35335 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
There are no known exploits in the wild.
CVE-2023-35336 Windows MSHTML Platform Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-35337 Win32k Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35338 Windows Peer Name Resolution Protocol Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35339 Windows CryptoAPI Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2023-35340 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35341 Microsoft DirectMusic Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-35342 Windows Image Acquisition Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35343 Windows Geolocation Service Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35344 Windows DNS Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35345 Windows DNS Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35346 Windows DNS Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35347 Microsoft Store Install Service Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35348 Active Directory Federation Service Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-35350 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35351 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35352 Windows Remote Desktop Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-35353 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35356 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35357 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35358 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35360 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35361 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35362 Windows Clip Service Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35363 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35364 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2023-35365 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35366 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35367 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-35373 Mono Authenticode Validation Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2023-35374 Paint 3D Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-36867 Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2023-36868 Azure Service Fabric on Windows Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2023-36871 Azure Active Directory Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2023-36872 VP9 Video Extensions Information Disclosure Vulnerability
There are no known exploits in the wild.

3 & Free Promotion: How to Upgrade to a Gen 7 NSsp Firewall for Free

You can’t afford to take any chances with malware – especially with ransomware gangs and other threat actors lurking around every corner. These cybercriminals are working to lock you out of your data and incapacitate the critical systems that keep your organization running. Given the escalating presence of cybercriminals and the ever-growing menace of malware, it is of utmost importance to guarantee that your organization possesses a firewall appliance that can promptly detect and block malware in real-time.

That’s why SonicWall is making it easy for you to optimize protection and upgrade to our latest Gen 7 NSsp Series next-generation firewalls with the return of our ‘3 & Free’ promotion.

What is the SonicWall ‘3 & Free’ Promotion?

The limited-time SonicWall 3 & Free NSsp promotion is an easy, cost-efficient way for customers to upgrade to the very latest SonicWall next-generation firewall appliance for free.

A chart that features the five key benefits of the Gen 7 NSsp next-generation firewall

Taking advantage of this promotion couldn’t be simpler: Through September 30th, 2023, current SonicWall customers (or those looking to swap out a competitor’s appliance) can receive a complimentary Gen 7 NSsp Series enterprise-grade firewall appliance just by purchasing our 3-Year Essential Protection Service Suite (EPSS) when upgrading or providing an eligible trade-in.

You need a security suite that can handle not only known threats but unknown threats as well. Our Essential Protection Service Suite (EPSS) has everything you need to stay protected in the ever-evolving landscape of cyber threats including protection against advanced malware, ransomware, encrypted threats, viruses, spyware, zero-day exploits and much more. Our comprehensive EPSS package includes:

  • Capture Advanced Threat Protection (ATP) with our patented Real-Time Deep Memory Inspection (RTDMI™)
  • Gateway Anti-Virus
  • Anti-Spyware
  • Comprehensive Anti-Spam
  • Content Filtering Services (CFS)
  • Application Control
  • Intrusion Prevention Services
  • 24×7 support including firmware

SonicWall’s award-winning Capture ATP is a cloud-based, multi-engine sandbox that can detect and block the most advanced threats before they have the chance to infect your network.

Included as part of Capture ATP, SonicWall’s patented RTDMI™ technology leverages proprietary memory inspection, CPU instruction tracking and machine-learning capabilities to become increasingly efficient at recognizing and mitigating never-before-seen attacks. This includes attacks that traditional sandboxes will likely miss, such as threats that don’t exhibit any malicious behavior and hide their weaponry via encryption.

In addition to industry-leading threat capabilities and simplified management, you’ll also enjoy the superior performance of SonicOS7 — our most powerful operating system yet, redeveloped from the ground up to be more agile, flexible and user-friendly than any of its predecessors.

SonicWall’s Traci McCulley Orr Honored as a Talent100 Leader

SonicWall’s Traci McCulley Orr, Senior Director of Global Talent Acquisition, has been honored by Talent100, the definitive power list of talent acquisition leaders across the United States and Europe. The Talent100 list recognizes innovative talent leaders from around the globe, showcasing those who are driving positive change and pushing boundaries in talent acquisition.

The Talent100 list is run by HIGHER, the world’s biggest community of talent acquisition professionals, with over 10,000 members worldwide. Their mission is to help every talent acquisition professional reach their full potential. The list is sponsored by Talentful, a leading global embedded talent consultancy.

“Being recognized on the Talent100 list is a remarkable accomplishment,” said SonicWall Senior Vice President and Chief Administration Officer Liz Johnson. “Traci is deserving of the honor, and I’m grateful to work with someone who contributes so much to the company and the team.”

Congratulations to Traci on this incredible accomplishment!

OpenEMR Reflected XSS Vulnerability

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  OpenEMR is a comprehensive open-source electronic health records (EHR) and medical practice management application. It provides an array of functionalities aimed at enhancing the efficiency of medical practice management. Among the critical features it provides are patient statistics, medical billing, electronic medical record (EMR) generation, and appointment scheduling. The listed capabilities empower medical practitioners, clinics, and hospitals to effectively manage and coordinate patient schedules, maintain detailed patient records, and streamline the billing process electronically. OpenEMR is designed with a flexible, user-friendly interface, making it an accessible solution for healthcare providers aiming to digitize and optimize their administrative and patient care processes. As an open-source platform, it also affords the flexibility of customization according to individual or institutional needs, further enhancing its applicability across a broad range of healthcare settings.

  A reflected cross-site scripting vulnerability has been identified in OpenEMR. This vulnerability arises from inadequate input validation associated with the ‘list_id’ parameter in ‘share_template.php’.

  A remote attacker could exploit this vulnerability by enticing a victim to open a crafted URL. Successfully exploiting this vulnerability could result in arbitrary code execution in the context of the victim’s browser.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-2948.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C).

  Base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is required.
    • Scope is changed.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 8.6 (E:P/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is proof of concept.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  The vulnerability stems from inadequate validation of the “list_id” parameter in the “share_template.php” file. When a request is submitted to the RequestURI at “library/custom_template/share_template.php”, it leads to the generation of HTML content by “share_template.php”. This content also encompasses some JavaScript code. Within the context of this generated JavaScript code, the value of the “list_id” parameter is manifested in the definition of a function called “add_template()”, as illustrated below:
  
  where $list_id is sanitized first by using PHP htmlspecialchars() function.

  However, the use of htmlspecialchars() for XSS sanitization in this case is ineffective, as it only escapes the characters “<", ">“, and single and double quotes. An attacker can bypass this limitation by sending malicious JavaScript code that excludes these specific characters in the “list_id” request parameter and delivering the request to the “share_template.php” endpoint. With a specially tailored “list_id” value, the attacker can interfere with the original “add_template()” function definition and append their own JavaScript code immediately after it. For instance, consider a situation where the “list_id” parameter contains a skillfully crafted value like the one below:
  
  Then “share_template.php” will generate the JavaScript code HTML format as below:
  
  In this scenario, the crafted value allows the original “add_template()” function definition to be escaped and a script command – “alert(55555)” – to be inserted right after the function’s conclusion. Consequently, the “alert(55555)” will execute when the server-returned HTML content is loaded in the user’s browser. If the “alert(55555)” were to be swapped with a different malicious script, it would lead to the execution of this harmful code in the browser, potentially triggering XSS opportunities.

Triggering the Problem:

  • The target system must have the vulnerable product installed and running.
  • The target user must have network connectivity to the affected ports.
  • The attacker must be able to deliver a malicious URL to a target user.

Triggering Conditions:

  A user is lured by an attacker into opening a URL that contains a carefully designed list_id parameter. The vulnerability manifests itself when the user initiates the URL in a web browser.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • HTTP
    • HTTPS
  

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 19216 OpenEMR Cross-Site Scripting

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Filtering traffic based on the signature above.
    • Upgrading the product to a non-vulnerable version.
  The vendor has released the following patch to address this issue:
  Vendor Advisory

Cybersecurity News & Trends – 07-07-2023

Today is National Comic Sans Day – we will not be participating, and we hope you won’t either. We hope you will read the 2023 Cyber Threat Report.

In industry news, Bleeping Computer has details on a ransomware attack that disrupted operations at the largest shipping port in Japan. Dark Reading has the lowdown on a Microsoft Teams vulnerability that could let outsiders send malware directly to internal users. TechCrunch breaks down new information about the MOVEit file transfer tool hacks. Hacker News reports on the takedown of OPERA1ER’s leader.

Remember to keep your passwords close and your eyes peeled – cybersecurity is everyone’s responsibility.

SonicWall News

How to Reach Compliance with HIPAA

TrendMicro, SonicWall News: According to the 2022 SonicWall Cyber Threat Report, healthcare continued a large spike in malware in 2021, at 121%. While the largest jump in IoT malware attacks belonged to healthcare, which saw a 71% year-over-year increase. To shed light on the significance malware can carry, it’s important to look at how recent breaches could’ve been circumvented by abiding to the HIPAA rules and safeguards.

Why Attackers Love to Target IoT Devices

VentureBeat, SonicWall News: Malicious objects were blocked on more than 40% of OT systems. SonicWall Capture Labs threat researchers recorded 112.3 million instances of IoT malware in 2022, an 87% increase over 2021.

Changes in the Ransomware Threat to State and Local Governments

StateTech, SonicWall News: According to SonicWall’s 2023 Cyber Threat Report, ransomware has “been on a tear” for the past few years, growing 105 percent year over year in 2021. While the report found that attacks were down in 2022, ransomware targets still reported very large number of attacks compared to levels in 2018, 2019 and 2020.

Clop’s MOVEit ransom deadline expires

ComputerWeekly, SonicWall News: At the time of writing, no data had yet been published, and SonicWall EMEA vice-president Spencer Starkey urged victims to hold the line in the face of the gang’s threats and grandstanding.

As the clock ticks closer, businesses impacted by the MOVEit hack may be tempted to pay off the hackers and move on. While this appears as the fastest way to resolve this, in fact, it actually feeds the monster, encouraging more attacks, said Starkey. On the other hand, not paying might lead to potential data loss and the cost of restoring systems, but it also helps starve these criminal operations and may discourage future attacks. At this stage, the key is customer and employee communication. The companies impacted must always strive to keep those channels flowing both ways, to reassure those who may be affected that they are doing everything possible to recover from and resolve the incident.

How Healthcare Organizations Are Looking at the Big Picture of Device Security

Health Tech, SonicWall News: Healthcare was the second most targeted industry for malware last year, according to SonicWall’s 2023 Cyber Threat Report. Internet of Things (IoT) malware attacks in healthcare increased 33 percent.

The Capita data breach explained

Verdict, SonicWall News: Immanuel Chavoya from SonicWall told Verdict the recent data breach happened due to an exposed “Amazon S3 bucket”.

Chavoya explains that they are able to be “accessed, altered, or even deleted by anyone who knows where to look and that breaks the core tenants of confidentiality integrity, and availability. However, sometimes, in the process of configuring a bucket, someone might unintentionally set the permissions to allow public access,” Chavoya said.

“For example, they might be trying to make it easier for a team to share files, or they might not realize the implications of making a bucket public,” Chavoya explained. “Unfortunately if sensitive data is stored in the bucket – which it was in this case, this can lead to a data breach. Therefore, it’s crucial to properly configure S3 bucket permissions and regularly review them to ensure they are still appropriately configured.”

How Generative AI Will Remake Cybersecurity

eSecurity Planet, SonicWall News: There are the potential data privacy concerns arising due to the collection and storage of sensitive data by these models,” said Peter Burke, who is the Chief Product Officer at SonicWall. Those concerns have caused companies like JPMorgan, Citi, Wells Fargo and Samsung to ban or limit the use of LLMs. There are also some major technical challenges limiting LLM use.

“Another factor to consider is the requirement for robust network connectivity, which might pose a challenge for remote or mobile devices,” said Burke. “Besides, there may be compatibility issues with legacy systems that need to be addressed. Additionally, these technologies may require ongoing maintenance to ensure optimal performance and protection against emerging threats.”

Companies Turn to Behavior-Based Cybersecurity Training to Stem Tide of Security Breaches

CIO Influence, SonicWall News: According to Glair, a company will never be able to train every person to spot every threat. That comes down to the sheer volume of novel threats being created. In fact, in the first half of 2022, SonicWall detected 270,228 never-before-seen malware variants. That’s an average of 1,500 new variants per day.

U.S.-South Korea Forge Strategic Cybersecurity Framework

Security Boulevard, SonicWall News: Immanuel Chavoya, SonicWall’s emerging threat expert, noted that the accord ushered in a new approach to cybersecurity that is based on cooperation and information sharing. “The introduction of a U.S./South Korea ‘Strategic Cybersecurity Cooperation Framework’ fundamentally alters the global cybersecurity landscape. It exemplifies a shift from siloed defenses to collective global security, fortifying the digital ecosystem against threats by pooling resources, intelligence and expertise,” Chavoya said. “This sends a message to nation-state actors like DPRK: The world’s cyberdefenders are uniting against threat actors who leverage our digital interconnectedness to disrupt our daily lives, making every digital interaction a new front line in this asymmetric war. As we often say, the best offense is a good defense—and in this case, it’s a defense extending traditional alliances across continents and cyberspace alike.”

Cyber Insurers May Want To Rethink Ransom Payments Based On This New Data

CRN, SonicWall News: In many cases, these “extortion-only” attacks are a more lucrative and easier alternative to the process of encryption and negotiation that’s involved in a typical ransomware attack, CrowdStrike’s threat intelligence head told CRN recently. SonicWall, meanwhile, cited extortion-only groups including Lapsus$ and Karakurt as further evidence of the trend.

Cryptomining group traced to Indonesia uses compromised AWS accounts

The Record, SonicWall News: Despite falling digital asset prices, cryptojacking reached record levels in 2022, according to research from cybersecurity firm SonicWall.

Rouble Malik Sheds Light On The Rising Threat Of Cybersecurity Attacks On Smes And Advocates Stronger Protective Measures

TechBullion, SonicWall News: The 2022 Cybersecurity Threat Report by SonicWall indicates a 62% increase in global ransomware attacks, demonstrating the evolving sophistication and prevalence of malware-based threats.

Industry News

Ransomware Gang Attacks Largest Port in Japan, Targets NUTS

Operations at the largest and most busy port in Japan have been disrupted following a ransomware attack. The Port of Nagoya, which accounts for approximately 10% of Japan’s total trade volume, handles 165 million tons of cargo every year. The automaker Toyota also uses the port to export almost all of its vehicles. The attack has disrupted multiple operations at the port, and the Port of Nagoya’s administrative authority released a notice about issues with the Nagoya Port Unified Terminal System (NUTS). The port authority is working tirelessly to fix the system and plans to resume normal functions this week. Until the system is fixed, all loading and unloading operations at terminals using trailers have been canceled. While no ransomware gang has publicly taken credit for the attack, it’s speculated that the attack was committed by the notorious LockBit ransomware gang.

TeamsPhisher Tool Lets Threat Actors Auto-Deliver Malware to Microsoft Teams Users

Threat actors and pen testers alike can obtain a new tool on GitHub that exploits a recently discovered Microsoft Teams vulnerability. The tool is called “TeamsPhisher” and can be abused in organizations where communication is allowed between internal and external Teams users. This means cyber criminals can simply send malware directly through a Teams message rather than jump through the hoops of social engineering or phishing scams. The tool was developed by Alex Reid, who is a member of the U.S. Navy’s Red Team. Reid used multiple techniques to develop the tool including one discovered by researchers at JUMPSEC Labs. Reid said that the tool works by first enumerating a target and then ensuring they can receive external messages. Once verified, the tool opens a new message thread with the user and sends a message that does not trigger the typical “Someone outside your organization messaged you” warning. The message can include malware or other dangerous files, and, since Teams doesn’t warn the users, it makes it more likely for unsuspecting users to open messages and download the files. The researchers at JUMPSEC have urged organizations using Teams to review whether they need to allow communications between internal and external users.

MOVEit Breach Continues to Claim More Victims

More organizations have been impacted by the MOVEit file transfer tool mass attacks with energy giant Shell and First Merchants Bank confirming that the attackers obtained sensitive data from them. According to a threat analyst at Emsisoft, the attacks have now affected more than 200 organizations and 17.5 million people. Shell did not say exactly what type of data the hackers had stolen from them, but the company did say some of it was personal information relating to employees. The attacks were orchestrated by the Russian hacking group known as Cl0p. The gang claimed that it had published Shell’s data on its website, but the links to the stolen data appear to be broken at this time according to TechCrunch. First Merchants Bank on the other hand said that Cl0p accessed customers’ addresses, Social Security Numbers, online banking usernames, payee information, and even account and routing numbers. The true extent of the MOVEit attacks won’t be known for quite some time. As of now, more and more victims are being revealed week by week.

OPERA1ER Leader Arrested by Interpol

Interpol has announced that an international operation codenamed ‘Nervone’ has resulted in the arrest of a high-ranking member of the hacking group called ‘OPERA1ER.’ The agency stated that the French-speaking gang has stolen anywhere from $11 million to $30 million in more than 30 attacks across multiple continents. The criminal organization has also gone by the names ‘Common Raven,’ ‘DESKTOP-GROUP’ and ‘NX$M$.’ According to Hacker News, the group’s attack chains typically involve spear-phishing lures that create a domino effect leading to tools like Cobalt Strike and Metasploit being deployed in order to steal sensitive data. Operation Nervone involved heavy cooperation between Interpol, AFRIPOL, Group-IB and Côte d’Ivoire’s Direction de l’Information et des Traces Technologiques. The CEO of Group-IB stated that they’ve been tracking OPERA1ER’s activities since 2019. This arrest will hopefully slow down the gang’s operations if not halt them entirely.

SonicWall Blog

Monthly Firewall Services Option for Simplicity and Scalability – Sorosh Faqiri

Monitoring and Controlling Internet Usage with Productivity Reports – Ashutosh Maheshwari

SonicWall NSM 2.3.5 Brings Enhanced Alerting Capabilities – Suriti Singh

Is Red/Blue Teaming Right for Your Network? – Stephan Kaiser

NSv Series and Microsoft Azure’s Government Cloud: Strengthening Cloud Security – Tiju Cherian

Four SonicWall Employees Featured on CRN’s 2023 Women of the Channel List – Bret Fitzgerald

NSv Series and AWS GovCloud: Facilitating Government’s Move to the Cloud – Tiju Cherian

The RSA Report: Boots on the Ground – Amber Wolff

The RSA Report – New Tactics, New Technologies – Amber Wolff

The RSA Report, Day 1: Protecting Objective Truth in Cybersecurity – Amber Wolff

The RSA Report: The Road to RSA – Amber Wolff

Agent Tesla RAT Disguised As NSIS Installer

Overview

The SonicWall Capture Labs Research team recently observed an Agent Tesla malware that is being loaded using Native Loader. Agent Tesla is an advanced Remote Access Trojan (RAT) developed using Microsoft .Net framework capable of stealing sensitive information. It has been one of the most prevalent malware families from the past couple of years.

In this blog post, we will discuss.

  • Capabilities of Agent Tesla with complete catalog of targeted software.
  • Understanding how Native Loader is used to load Agent Tesla.
  • Evolution of Agent Tesla’s String Decryption Algorithm.
  • Approach for Automatic String Decryption.

Introduction

Agent Tesla malware first appeared in 2014 has been active for over last nine years and it is constantly being updated by its threat actor by adding new capabilities. Agent tesla’s main objective consists of credential stealing, keylogging, screen capture, clipboard capture, stealing victims’ application data and send it to threat actor.

Infection Cycle

Agent Tesla is mainly delivered though phishing emails.

Fig 1. Infection Cycle

Unpacking of AgentTesla

Recent variant of Agent Tesla is being distributed as NSIS Installer consisting of NSIS script, DLL plugin and encrypted payload’s file.

Fig 2. Extracted Files of NSIS installer

Layer 1 – Plugin DLL

NSIS-plugin DLL calls its the exported function “HvDeclY” which decrypts the layer 2 shellcode.

Layer 2 – Shellcode

API HASHING

Shellcode uses API Hashing to obfuscate API calls.

Fig 3. Custom API Hashing Algorithm

ANTI-EMULATION

Shellcode crash itself by jumping to invalid address when dwNumberOfProcessors < 1 or VirtualAllocExNuma API not able to allocates memory.

Shellcode has an Anti-Emulation check – It allocates the 381 MB of memory space, set each byte to 0 and free that memory space.

On 64-bit system, Shellcode uses heaven’s gate technique to avoid analysis by debugger.

Fig 4. Heaven’s Gate call

PROCESS HOLLOWING

On 64-bit system Shellcode executes some API’s using Syscall instruction that are used for Process Hollowing. On 32-bit same APIs are using Sysenter instruction.

Fig 5. 64-bit Code, Syscall through Heaven’s Gate

This layer serves as loader to begin the execution of native loader.

Native Loader

Layer 2 shellcode decrypts an encrypted native C++ loader and start its execution. This Agent Tesla variant has a noteworthy difference from previously examined variants, in this variant Agent Tesla is loaded via a native C++ loader instead of multiple stages of .net assembly modules.

Native loader stores the final payload Agent Tesla in its resource’s directory. The Common Language Runtime is integrated by the loader via CLR Hosting Interfaces in order to load and run .Net assemblies. Mscoree DLL implements functions that is used for CLR hosting.

Fig 6. API’s call sequence to load .Net managed assembly from unmanaged code.

This native loader injects the final Agent Tesla payload in newly created process and start its execution.

Technical Analysis of Agent Tesla

Capabilities of Agent Tesla

This recent version of Agent Tesla harvest variety of sensitive data from a wide selection of browsers, VPN, FTP , Email clients and more. Sensitive data of the application includes its credentials, “\user data” directory of particular browser, Cookies from browser and FTP application, Configuration data.

  • Data Harvesting 
    • Browsers: IE/Edge, UC Browser, Safari for Windows, QQ Browser, Falkon Browser, Flock Browser, Opera Browser, Yandex Browser, Iridium Browser, Chromium, 7 Star, Torch Browser, Cool Novo, Chrome Plus, Kometa, Amigo, Brave, Cent Browser, Chedot, Orbitum, Sputnik, Comodo Dragon, Vivaldi, Citrio, 360 Browser, Uran, Liebao Browser, Elements Browser, Epic Privacy, Cốc Cốc browser, Sleipnir 6, QIP Surf, Coowon, Google Chrome, Edge Chromium, Firefox, SeaMonkey, BlackHawk , CyberFox, K-Meleon, IceCat, Pale Moon, IceDragon, WaterFox, Postbox
    • Email clients: Eudora, The Bat, Becky, Outlook, Windows Mail App, FoxMail, Opera Mail, PocoMail, eM Client, Mailbird, Thunderbird,  Claws,  IncrediMail.
    • FTP/SCP clients: FileZilla, CoreFTP, WinSCP, Flash FXP, FTP Navigator, SmartFTP, WS_FTP, FtpCommander, FTPGetter.
    • Databases: Berkelet DB, MySQL Workbench.
    • VPN clients: NordVPN, OpenVPN, Private Internet Access VPN.
    • Virtual network computing clients: RealVNC, WinVNC3, TightVNC, UltraVNC.
    • Instant Messaging programs: Discord, Paltalk, Pidgin, Psi/Psi+, Trillian
    • Dynamic DNS clients: DynDns
    • Download Managers: JDownloader, Internet Downloader Manager
    • Windows Credentials: Windows Secure Note, Windows Web Password Credential, Windows Credential Picker Protector, Web Credentials, Windows Credentials, Windows Domain Certificate Credential, Windows Domain Password Credential, Windows Extended Credential
  • Keystrokes logging
  • Clipboard Scraping
  • Screenshot Capturing
  • Deleting Zone identifier
    • Agent Tesla deletes Zone Identifer to remove its trace that origin of file is untrusted source.

      Fig 7. Deleting Zone identifier

Fingerprinting

Agent Tesla uses Computer name, Operating System , Processor name, Total memory, Current date and time , IP Address, Internet connectivity and Username, MacAddress, Serial Number for fingerprinting.

Persistence

Agent Tesla achieves persistence by adding two autorun registry keys.

  • Software\Microsoft\Windows\CurrentVersion\Run
  • SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run

Exfiltration

Normally Agent Tesla exfiltrate collected data via FTP, HTTP, SMTP and Telegram bot, but in this variant it only uses SMTP to exfiltrate data.

Malware uses compromised email account to exfiltrate collected data to mail server which is being managed by the attacker.

The above discussed techniques are similar in most of the .Net stealers. The SonicWall research team has provided a full explanation for above techniques in Unmasking .Net Stealer and Redline blog posts.

Configuration Data

Agent Tesla keeps its configuration data encoded.

Fig 8. Agent Tesla’s Decoded Configuration Data

Evolution of String decryption Algorithm

In this section we will discuss the evolution of string decryption algorithms of Agent Tesla.

Agent Tesla is actively changing its tactics to hide from security software’s. One of the tactics is string encryption, it is crucial to keep them hidden from security software and reverser’s. All the important configuration data and ioc’s such as browser names  list, c2 host name, smtp credentials in Agent Tesla are stored as encrypted strings.

Version 1

In this version encrypted strings are stored as base64 encoded.

The SHA1 hashing algorithm is used by decryption function “s_method_0” to generate a key using a hardcoded password and salt. The base64 decoded string is then decrypted with the AES algorithm using CBC mode using the generated key and hardcoded IV.

Fig 9. AES Decryption Function(bottom), example of encrypted string(top)

Version 2

In this version Agent Tesla uses AES algorithm in CBC mode same as in version 1 but it uses different Key and IV for each decryption the string. Strings are stored in an array of object, where each object has three elements that are an encrypted string, Key and IV.

 

Fig 10. AES Decryption Function(bottom), example of encrypted string(top)

Version 3

In this version Agent Tesla implements simple Xor decryption. Xored strings are stored in array of bytes.

Decryption function is defined in .cctor() constructor of binary file. When malware starts its execution, its constructor gets called automatically and it decrypts an encrypted string array using hardcoded Xor byte-size key. To locate an exact string malware uses array offset and size of string as there is no separator between strings.

Fig 11. Simple Xor decryption(bottom), example of encrypted string(top)

Version 4

In this version Agent Tesla author has copied and abused an open-source .NET string encryption tool XorStringsNET .

In this version strings are stored as encrypted data blob. Data blob has below format.

As per .NET file format data blob is stored as field of structure as shown below.

Fig 12. Data blob stored as structure with size of =19953 bytes

Approach for string decryption

1) We can use de4dot tool to automatically decrypt the strings and get binary file with strings are decrypted. It comes with multiple options to manipulate the .Net binary file.

Consider below command as example to decrypt the strings.

de4dot.exe -f file -o outfile –strtyp delegate –strtok 0x6000001

strtok – Enter the method token of the Decryption method. We can get it easily using DnSpy.

Fig 13. de4dot cmdline options

strtyp – This option can be one of the below methods.

Fig 14. String decrypter type available

2) Python Scripts by parsing .Net metadata.

Writing python script to decrypt strings automatically, we need to find required data as below.

  • .Net metadata – Parse required metadata such as Method/Structure Token, RVA, File offset required for string decryption.

Many open source .Net parsing libraries are available on Github.

Conclusion

Agent Tesla RAT has been active from several years and it is continuing to evolve. It has developed new ways such as use of native C++ loader for evading detection. Agent Tesla is successfully able to harvest and exfiltrate data to the attacker. In each version Agent Tesla continues to improve its string encryption functions and addition into its data stealing capability catalog . We expect major improvements in the next version of it.

SonicWall Capture Labs provides protection against this threat via the following signature:

  • GAV: AgentTesla.A (Trojan)

This threat is also detected by SonicWall Capture ATP w/RTDMI and the Capture Client endpoint solutions.

IOC’s

D63FE952E90788072C6166A39BDE21B5 – NSIS Installer

B67E8512632AAE047A483B643EA6B1B4 – NSIS Plugin DLL

F8F2ED5A4E1FB2F14D49349CE4E2B779 – Encrypted Stage 2

57B264BF971F2BCF62140130CFD94CF5 – C++ Loader

A0A5B08B0EFFF9FAA96455B699893F76 – Agent Tesla

OpenSSL OBJ_obj2txt Vulnerability

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  OpenSSL stands as a renowned open-source library, primarily utilized for SSL and TLS. The Secure Socket Layer (SSL) and the Transport Layer Security (TLS), referenced interchangeably from this point onward, are cryptographic protocols designed to ensure communication security, data integrity, and authentication over TCP/IP networks. By harnessing the power of cryptography primitives—symmetric key ciphers, cryptographically robust hash functions, and the Public Key Infrastructure (PKI)—these protocols facilitate secure communication between hosts over unsecured networks.

  PKI, a prevalent authentication system for TLS, is dependent on certificates for conveying necessary cryptographic data, such as RSA keys, signatures, and identity information, all vital for encryption and authentication. The ITU standard, X.509, details the structure of these public-key certificates.

  There are three existing versions of X.509: X.509 v1 and v3 are older and newer standards, respectively, utilized for certificate representation. Conversely, X.509 v2 outlines the standard for representing Certificate Revocation Lists (CRLs). These certificate representations are outlined using Abstract Syntax Notation One (ASN.1) and encoded via the Distinguished Encoding Rules (DER).

  Recently, a denial-of-service vulnerability has been discovered in the OpenSSL library. This vulnerability emanates from delays encountered during the processing of ASN.1 OBJECT IDENTIFIERs.

  A remote attacker can exploit this vulnerability by transmitting specially crafted packets to an OpenSSL client, or a server that has purposefully activated client authentication. Should this exploitation prove successful, it could instigate denial-of-service conditions on the impacted service.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-2650.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 4.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C).

  Base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is none.
    • Impact of this vulnerability on data integrity is none.
    • Impact of this vulnerability on data availability is low.
  Temporal score is 4.6 (E:U/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is unproven.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  It’s important to shed light on the OBJECT IDENTIFIER tag and its workings. The OBJECT IDENTIFIER data type, encoded into a TLV (Type, Length, Value) triplet, commences with a Tag value of 0x06. The encoding of each integer in a dotted decimal object identifier (OID) is governed by a set of specific rules. First and foremost, the OID’s initial two nodes are encoded onto a solitary byte, with the first node being multiplied by the decimal 40 and the result is added to the second node’s value. Secondly, node values that are either equal to or less than 127 are encoded on a single byte. Lastly, node values that are equal to or exceed 128 are encoded on multiple bytes, with Bit 7 of the leftmost byte set to one and Bits 0 through 6 of each byte containing the encoded value.

  For illustration, consider the OBJECT IDENTIFIER “1.3.6.1.4.1.311.21.20”. It would be encoded as follows: “06 09 2b 06 01 04 01 82 37 15 14”. Here, “06” stands for the OBJECT IDENTIFIER tag, “09” represents the length of the OBJECT IDENTIFIER, and the subsequent bytes are the encoded values, utilizing the previously mentioned three rules.

  OpenSSL library incorporates support for parsing ASN.1 encoded OBJECT IDENTIFIER in DER format. More specifically, it provides an API known as OBJ_obj2txt() for data parsing. This function commences decoding from the first byte, interpreted as the two initial sub-identifiers, as per Rule 1. Post this, the function scrutinizes each byte of the remaining encoded data in a while loop. The value will be directly regarded as the decimal sub-identifier if it’s less than 0x80 (128), aligning with Rule 2. If the value equals or exceeds 0x80, the function discards Bit 7, storing only the left 7 bits (Bits 6 – 0), and repeats this step in a for loop until a byte less than 0x80 is encountered. The function then concatenates all the lower 7 bits in these bytes and converts the bit stream into an integer. This integer’s decimal value will be the sub-identifier. Nevertheless, this function does not impose restrictions on the length of the encoded OBJECT IDENTIFIER data. Consequently, the decoding step could be extensively time-consuming if the concatenated value forms a large integer.

Triggering the Problem:

  • The target must be running a vulnerable version of the affected product.
  • The attacker must have the ability to delivery a malicious ASN.1 DER file to the target

Triggering Conditions:

  The vulnerability can be exploited if the attacker successfully delivers a malicious certificate or any other file in DER format to applications utilizing the OpenSSL library. The vulnerability is subsequently triggered upon the parsing of this malicious file, establishing a potential security risk for the system.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • FTP
    • HTTP
    • HTTPS
    • IMAP
    • NFS
    • POP3
    • SMB/CIFS
    • SMTP
    • ESMTP
    • SIPS

  Get Request:
  

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS:19207 OpenSSL OBJ_obj2txt Function DoS

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Apply the vendor-provided patch to eliminate the vulnerability.
    • Filter attack traffic using the signature above.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory