ToddyCat Tracked, NTLM Relay Attack, Beware Zombie Bugs, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 21 June, 2022
Episode 249 - 21 June 2022
ToddyCat Tracked- https://www.bleepingcomputer.com/news/security/new-toddycat-apt-group-targets-exchange-servers-in-asia-europe/
NTLM Relay Attack -
https://thehackernews.com/2022/06/new-ntlm-relay-attack-lets-attackers.html
OT Insecure by Design- https://www.securityweek.com/basecamp-icefall-secure-design-ot-makes-little-headway
Microsoft Re-Arms Windows -
https://www.zdnet.com/article/microsoft-this-out-of-band-windows-security-update-fixes-microsoft-365-sign-in-issues-for-arm-devices/
Beware Zombie Bugs -
https://www.theregister.com/2022/06/21/apple-safari-zombie-exploit/
Hi, I’m Paul Torgersen. It’s Tuesday June 21st, 2022, and from Chicago this is a look at the information security news from overnight.
From BleepingComputer.com
A new APT group dubbed ToddyCat has been targeting Microsoft Exchange servers throughout Asia and Europe. According to the Kaspersky researchers, it looks like they have been in action since at least December of 2020. Kaspersky has also found a previously unknown passive backdoor they named Samurai and new trojan malware dubbed Ninja Trojan. Both malware strains allow the attackers to take control of infected systems and move laterally within the victims' networks.
From TheHackerNews.com:
A new Windows NTLM relay attack dubbed DFSCoerce has been uncovered that leverages the Distributed File System: Namespace Management Protocol to seize control of a domain. This follows a similar method called PetitPotam that abuses Microsoft's Encrypting File System Remote Protocol to coerce Windows servers into authenticating with a relay under an attacker's control. To mitigate NTLM relay attacks, Microsoft recommends enabling Extended Protection for Authentication, SMB signing, and turning off HTTP on AD CS servers.
From SecurityWeek.com:
Ten years after project Basecamp, Forescout has conducted an updated project, dubbed OT:Icefall, to gauge the current state of Security By Design in OT products. They found 56 insecure by design problems stemming from ten manufacturers. Forescout says the flaws are not programming error vulnerabilities, but rather flaws in the protocols, authorizations, and certifications built into the designs. Seems not enough has changed in the last 10 years.
From ZDNet.com:
Microsoft has issued an out-of-band update for Windows 11 and Windows 10 to fix an issue that emerged with Arm devices after their latest Patch Tuesday update. It seems some users were prevented from signing into applications including VPN connections, Microsoft Teams, and Microsoft Outlook. The issue only affects Windows devices that use Arm processors; machines using other processors are not affected. If that is you and you have not yet applied the June 14 updates, you should use this out of band update instead.
And last today, from TheRegister.com
Beware of zombie vulnerabilities. The Safari browser had a vulnerability that was completely patched by Apple back in 2013 when it was discovered. Unfortunately that fix was regressed in 2016 during some code refactoring. That same bug was found being exploited earlier this year. It is unsure for how many of those five years the de-patched bug was being exploited in the wild. See the details and a link to the Google Project Zero research in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.