Critical Cisco vulnerabilities. Several Windows zero-days. Salesforce outage due to permissions bug.  24th May 2019

ThangryCat: critical Cisco router bugs

I somehow missed this last week. Maybe I'm getting numb to news articles starting with "security problem in Cisco product". Sarcasm aside, this seems serious.

<Takes deep breath>

There's a vulnerability that bypasses Cisco's Trust Anchor module, allowing an attacker to change anything they want without the security module detecting it. There's no patch yet, and once there is one you'll have to physically access the device to update, it can't be done remotely.
To exploit this vulnerability, you need the second disclosed vulnerability to get remote admin access. There is a patch for that one though, which you'll want to get asap.
There's another summary here, and the page of the researchers themselves here.

Several Windows 10 zero-day/PoC exploits released

The hacker known as SandBoxEscaper, who has previously released Windows zero-days, has been busy this week, releasing no less than four zero-days/proof-of-concept exploits. I'm a bit hazy on which are zero days and which are exploits for known vulnerabilities, but either way: if you manage Windows systems you'll want to take a closer look.

Faulty database script brings Salesforce to its knees

Salesforce had a big facepalm moment this week. A change that they made in their production environment gave all employees access to all company files.
Only users of Salesforce Pardot were directly affected, but the company did take down all Salesforce services for a while to be certain.

Google bans Huawei from accessing Android & its licensed apps

There'a slew of companies cutting various ties with Huawei after Trump's executive order. It makes sense, I suppose, to not put critical infrastructure in the hands of a foreign power. But, as this article points out, there's still no evidence of malicious acts, and it would be very risky for China to include backdoors at all.

Google stored some passwords in clear text

It's not as horrible as the recent similar Facebook stories, but still not great of course. It relates to a feature of Gsuite Enterprise where an admin can manually set a password for a user. Those passwords were stored in plain text.

Some gov.uk sites unreachable due to HSTS changes in Windows update

Often when someone connects to your HTTPS site, their browser will first go to the regular (unsecured) HTTP endpoint before being redirected. But if the site is on the HSTS pre-load list, their browser will know to go straight to HTTPS.
Microsoft shipped an update adding *.gov.uk to that pre-load list, but unfortunately not all .gov.uk sites support HTTPS yet, which made them unreachable to the people who got that update. Microsoft pushed another update to fix the issue.

Bestmixer seized for washing $200 million in tainted cryptocurrency

Mixing services are used to launder cryptocurrency, converting and wiring between various currencies and accounts so that law enforcement can't trace the coins back to the attackers. One of the bigger ones, Bestmixer, has been taken down by Europol, in collaboration with Dutch and Luxembourg authorities and McAfee.

Google research: How effective is basic account hygiene at preventing hijacking

Google performed research to see just how effective their security measures are in practice. It turns out that just enabling phone verification stops 100% of automated bots, 96% of bulk phishing attacks and 76% of targeted attacks. As you'd expect, the numbers go up even further if you progress to non-SMS based 2fa like on-device prompts and security keys.

US Marine Corps seeks volunteers for civilian cybersecurity team

I recently shared an article on this topic, but I had no idea they were actually working on this already. If you're a US citizen with infosec skills, and if you can qualify for security clearance, you can sign up as a cybersecurity volunteer at the USMC.

Slack bug allows remote file hijacking and malware injection

The issue has been patched, but I did find it an interesting read. The vulnerability exists in the slack:// protocol handler, which can be tricked into downloading anything the user clicks to a remote SMB share. Victims will still open the attachment, which then streams from the attacker's SMB server.

The Hacker's Hardware Toolkit

A fun project to browse through, showing a catalogue of hardware that can be useful to Red Teamers and pentesters. The links don't seem to point to anywhere that I can see, you'll want to go straight to the pdf.