Perpetual IT

We delve into Google’s tight-lipped Chrome bugfix, explain how a Belgian researcher awarded himself 111,848 cups of coffee, and discuss the audacious but thankfully temporary theft of the Perl.com domain.

With Kimberly Truong, Doug Aamoth and Paul Ducklin.

Intro and outro music by Edith Mudge.

WHERE TO FIND THE PODCAST ONLINE

You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher, Overcast and anywhere that good podcasts are found.

Or just drop the URL of our RSS feed into your favourite podcatcher software.

If you have any questions that you’d like us to answer on the podcast, you can contact us at tips@sophos.com, or simply leave us a comment below.

As you know, our usual advice for Patch Tuesday boils down to four words, “Patch early, patch often.”

There were 56 newly-reported vulnerabilities fixed in this month’s patches from Microsoft, with four of them offering attackers the chance of finding remote code execution (RCE) exploits.

Remote code execution is where otherwise innocent-looking data that’s sent in from outside your network can trigger a bug and take over your computer.

Bugs that make it possible for booby-trapped chunks of data to trick your computer into executing untrusted code are much sought after by cybercriminals, because they typically allow crooks to break in and implant malware…

…without popping up any “are you sure” warnings, without needing niceties like a username and a password, and sometimes without even leaving any obvious traces in your system logs.

With all of that in mind, the statistic “56 fixes including 4 RCEs” signals more than enough risk on its own to make patching promptly a priority.

In the wild

As well as the four potential RCE holes mentioned above, there’s also a patch for a bug dubbed CVE-2021-1732 that is already being abused in the wild by hackers.

The situation where an attack is known before a patch comes out is known as a zero-day bug: the crooks got there first, so there were zero days on which you could have patched to be ahead of them.

Fortunately, this zero-day bug isn’t an RCE hole, so crooks can’t use it to gain access to your network in the first place.

Unfortunately, it’s an elevation of privilege (EoP) bug in the Windows kernel itself, which means that crooks who have already broken into your computer can almost certainly abuse the flaw to give themselves almighty powers.

Having crooks inside your network is bad enough, but if their network privileges are the same as a regular user, the damage they can do is often fairly limited. (That’s why your own sysadmins almost certainly don’t let you run with Administrator rights any more like they used to back in the 2000s.)

Ransomware criminals, for example, typically spend time at the start of their attack looking for an unpatched EoP bug that they can exploit to boost themselves to have the same power and authority as your own sysadmins.

If they can grab domain administrator rights, they’re suddenly on an equal footing with your own IT department, so they can pretty much do whatever they like.

Intruders who have access to an EoP exploit will probably be able to: access and map out your entire network; alter your security settings; install or remove any software they like on any computer; copy or modify any file they like; tamper with your system logs; find and destroy your online backups; and even to create secret “backdoor” accounts that they can use to break back in if you find them this time and kick them out.

But that’s not all

If you’re still not convinced to patch early, patch often, you might also want to read Microsoft’s special security bulletin entitled Multiple Security Updates Affecting TCP/IP.

The three vulnerabilities listed in this bulletin are the uninterestingly named CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086.

The bugs they represent, however, are very interesting indeed.

Even though Microsoft admits that two of them could, in theory, be exploited for remote code execution purposes (thus they make up 2 of the 4 RCE bugs mentioned above), that’s not what Microsoft is most worried about right now:

The two RCE vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely [to be abused] in the short term. We believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release. Thus, we recommend customers move quickly to apply Windows security updates this month.

The DoS exploits for these CVEs would allow a remote attacker to cause a stop error. Customers might receive a blue screen on any Windows system that is directly exposed to the internet with minimal network traffic.

DoS, of course, is short for denial of service – a type of vulnerability that’s often downplayed as the “last amongst equals” when compared to security holes such as RCE and EoP.

Denial of service means exactly what it says: crooks can’t take over a vulnerable service, software program or system, but they can stop it working altogether.

Unfortunately, these three DoSsable holes are low-level bugs right down in the Windows kernel driver tcpip.sys, and the flaws can, in theory, be tickled-and-triggered simply by your computer receiving incoming network packets.

In other words, just proceesing the packets in order to decide whether to accept and trust them in the first place could be enough to crash the targeted computer – which could, of course, be a mission critical internet-facing server.

What to do?

Microsoft itself is warning you to prioritise these patches if you like to do your updates one-at-a-time, and has even come up with scriptable workarounds for those who are still afraid of the “patch early” principle:

It is essential that customers apply Windows updates to address these vulnerabilities as soon as possible. If applying the update quickly is not practical, workarounds are detailed in the CVEs that do not require restarting a server.

Despite the workarounds, we’re with Microsoft here, and we agree wholeheartedly with the words essential and as soon as possible.

Don’t delay. Do it today!

We’re all appalled at scammers who take advantage of people’s fears to sell them products they don’t need, or worse still products that don’t exist and never arrive.

Worst of all, perhaps, are the scammers who offer products and services that do exactly the opposite of what they claim – making their victims pay up simply to make them even easier to defraud in future.

Well-known cyberexamples of this sort of fraud include:

• Fake technical support incidents. These are the web popups or the phone calls you get out of the blue that report ‘viruses’ on your computer, and persuade you to ‘hire’ the services of an online ‘expert’ to remove them. Often these victims are lonely, vulnerable, and particularly ill-placed to deal with the financial loss. The scammers then target those individuals repeatedly and, in some cases we have heard, with ever-increasing aggression.
• Fake home delivery scams. These are typically emails or SMSes (text messages) that say a delivery has been delayed. Thanks to coronavirus restrictions, many more people are relying on home deliveries than a year ago, so it feels pretty harmless to click the link you’ve been given. However, you end up on a fake web site that goes after your password or credit card details.
• Fake purchase notifications. Apple is one of the most targeted brands here, along with other household names such as Amazon and Netflix. Given that the amount of the transaction is often quite modest, it feels harmless enough simply to contest it online, using the handy but fraudulent phishing link included.
• Fake fraud warning calls. Vishing, or phishing via voice, is a variant on the previous fake purchase scams, where a synthetic voice recites an item that you didn’t buy, and then offers you a chance to ‘press 1 to contest this purchase’. You end speaking to a call centre where scammers with the gift of the gab talk you into handing over credit card data to ‘fix’ a mistake that never happened.
• Fake overdue account warnings. Like fake delivery notices, these are commonly received via SMS so that the crooks only need to come up with a brief note in abbreviated English. The accounts involved are often ones you expect to pay automatically, such as monthly phone and utiliy bills, and the scammers aim to lure you to a fake website to defraud you.

Beware “beg bounties”

Well, there’s a new kid on the technoscammology block: bogus bug reports!

Sophos researcher Chester Wisniewski has dubbed these “beg bounties”, because they’re unsolicited messages that are begging for your attention, and we suggest that you read his excellent writeup to find out what these beggars are up to:

You probably know that many companies these days have a way for bug hunters – some of whom make their living from figuring out out security holes in corporate websites and software – to report problems they’ve found, and potentially to get paid for their work.

As haphazard as this sounds, bug bounty programmes usually follow a well-structured format, and professional bug hunters work carefully within well-defined limits while they’re probing for holes.

The idea of so-called responsible disclosure policies (you can find bug submission instructions for Sophos on our main website) is that they give bug bounty hunters a realistic amount of freedom to explore for holes without getting prosecuted for illegal hacking.

At the same time, bug bounty programmes typically have sufficiently well-defined boundaries that they don’t offer a casual “get out of jail free” excuse that could be abused by criminals whose intention is not to help fix problems but to find and exploit them.

For example, if you want to go bug hunting on behalf of Sophos, you have to agree, amongst other things:

• That you will not modify or destroy data that does not belong to you, which loosely means that you will try to act online like an environmentally sound hiker who is following informal bush guidance to “take only pictures and leave only footprints”.
• That you will make a good faith effort to avoid privacy violations as well as destruction, interruption or segregation of our services, which loosely means that you will do your best to prove your point without harming anyone else.
• That you will allow [us] an opportunity to correct a vulnerability within a reasonable time frame before publicly disclosing the identified issue, which implies that your motivation, over and above getting a bounty, is to improve security and close holes rather than learning how to bypass security to exploit them.

Note that the idea of bug hunting is not simply to show that you can break things if you want, like a street vandal who has figured out that you can smash up a bus shelter with a baseball bat, but to find and document real-world flaws with sufficiently scientific rigour that they can be traced down non-destructively and reliably fixed.

The professional bug hunting community, therefore, has become a largely self-regulating group.

If you don’t have the right level of expertise, you’ll find it hard to come up with work of sufficient quality to to make your evidence repeatable and reliable; if you don’t have the right level of morality, you’ll find it hard to play fair enough to quality for the bounty anyway, and difficult to get accepted by the commnuity.

Baffle them with technobabble

Chester’s so-called “beg bounty hunters” don’t care about any of this, because their modus operandi goes something like this:

• Find the technical contact for a company or website.
• Produce some technobabble text that claims to have found a vulnerability, possibly supported by a scary-sounding description copied and pasted from a security scanning tool (or even just from Wikipedia or a similar community website).
• Mail the technobabble across, together with some sort of thinly-disguised demand either for a contract gig to ‘fix’ the ‘vulnerability’, or for payment for ‘finding’ the ‘hole’, or both.

The examples in Chester’s article give you a good idea of the nebulous way that these bluffers operate.

Some of these chancers, to be scrupulously fair, may genuinely consider themselves to be bug hunters with sufficient skills to help you secure your network better, and may not actually be charlatans or criminals operating with malice aforethought.

One of the sample “beg bounties” that Chester dissected, for example (we’ve received one of these ourselves), tells you that you have a security hole in your website, but backs up the claim with some copied-and-pasted waffle about a security technology that applies to email servers.

So the most generous interpretation of this “beg bounty” report is that the sender is technically incompetent almost without limit, and ought not to be allowed near your network to do cybersecurity work.

Other beg bounty chancers, it’s fair to say, are unreconstructed scaremongers who are trying it on without going quite as far as saying “pay up or else”, which would be blackmail.

Clearly, they’re not the sort of people you could trust near your network, either.

What to do?

Here’s Chester’s advice:

• Don’t reply to unsolicited offers to ‘fix’ your network. Treat these charlatans like the fake technical support scammers we mentioned above, who call out of the blue and bully you into accepting and paying for ‘help’ you can’t trust and didn’t need.
• Contact a local trustworthy firm to assess your security weaknesses. Look for a team that will work with you to help you improve your security situation from first principles.

After all, if there is any truth in an alleged security hole that a self-proclaimed bounty hunter reported to you, a trustworthy security and penetration testing company should find it and help you to fix it properly.

But if the alleged vulnerability is made-up garbage, a trustworthy cybersecurity partner will figure that out too, and stop you wasting money on a ‘precaution’ that does nothing except to give you a false sense of security.