Mozilla VPN Security Risks Discovered via @sejournal, @martinibuster

Mozilla published the results of a recent third-party security audit of its VPN services as part of it’s commitment to user privacy and security. The survey revealed security issues which were presented to Mozilla to be addressed with fixes to ensure user privacy and security.

Many search marketers use VPNs during the course of their business especially when using a Wi-Fi connection in order to protect sensitive data, so the  trustworthiness of a VNP is essential.

Mozilla VPN

A Virtual Private Network (VPN), is a service that hides (encrypts) a user’s Internet traffic so that no third party (like an ISP) can snoop and see what sites a user is visiting.

VPNs also add a layer of security from malicious activities such as session hijacking which can give an attacker full access to the websites a user is visiting.

There is a high expectation from users that the VPN will protect their privacy when they are browsing on the Internet.

Mozilla thus employs the services of a third party to conduct a security audit to make sure their VPN is thoroughly locked down.

Security Risks Discovered

The audit revealed vulnerabilities of medium or higher severity, ranging from Denial of Service (DoS). risks to keychain access leaks (related to encryption) and the lack of access controls.

Cure53, the third party security firm, discovered and addressed several risks. Among the issues were potential VPN leaks to the vulnerability of a rogue extension that disabled the VPN.

The scope of the audit encompassed the following products:

• Mozilla VPN Qt6 App for macOS
• Mozilla VPN Qt6 App for Linux
• Mozilla VPN Qt6 App for Windows
• Mozilla VPN Qt6 App for iOS
• Mozilla VPN Qt6 App for Androi

These are the risks identified by the security audit:

• FVP-03-003: DoS via serialized intent
• FVP-03-008: Keychain access level leaks WG private key to iCloud
• VP-03-010: VPN leak via captive portal detection
• FVP-03-011: Lack of local TCP server access controls
• FVP-03-012: Rogue extension can disable VPN using mozillavpnnp (High)

The rogue extension issue was rated as high severity. Each risk was subsequently addressed by Mozilla.

Mozilla presented the results of the security audit as part of their commitment to transparency and to maintain the trust and security of their users. Conducting a third party security audit is a best practice for a VPN provider that helps assure that the VPN is trustworthy and reliable.

Read Mozilla’s announcement:
Mozilla VPN Security Audit 2023

Featured Image by Shutterstock/Meilun

Microsoft Mitigates Hacker Access To Government Email Accounts via @sejournal, @kristileilani

Microsoft announced that it recently blocked a group of hackers, which it labeled Storm-0558, that accessed email accounts belonging to around 25 organizations, including government agencies.

How Hackers Gained Access To Email Accounts

In a blog post, Microsoft said it began investigating abnormal activity in some email accounts on June 16 after being notified by customers.

Its investigation revealed that beginning May 15, the hacking group exploited a vulnerability to forge authentication tokens and gain entry into organizations’ Microsoft 365 accounts.

Using a compromised Microsoft consumer account signing key, the hackers could impersonate users and access email accounts through services like Outlook Web Access and Outlook.com.

According to a recent joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, the federal agency observed suspicious activity in its Microsoft 365 logs.

This led to the discovery that advanced persistent threat actors had accessed and exfiltrated data from some Exchange Online Outlook accounts.

What Is Storm-0558?

According to Microsoft’s actor profile of Storm-0558, the description of the group is as follows:

Storm-0558 (DEV-0558) is a nation-state activity group based out of China. They focus on espionage, data theft, and credential access. They are also known to use custom malware that Microsoft tracks as Cigril and Bling, for credential access.

How The Issue Was Resolved

CISA and the FBI advised organizations using Exchange Online to implement enhanced monitoring and logging to detect similar attacks.

Their recommendations include enabling advanced audit logging features and gaining visibility into standard cloud traffic patterns.

Microsoft claims it has fully resolved the issue and blocked the hackers’ access. It is working with impacted customers and has notified them ahead of its public disclosure.

The company said it had found no evidence the hackers remained in any corporate systems.

Mitigating Future Cyberattacks

This latest activity comes as cyberattacks continue to increase against organizations worldwide.

United States Senator Mark R. Warner, Chairman of the Senate Select Committee on Intelligence, expressed concern over reports of the latest cyberattack and what would be needed to prevent future incidents.

“The Senate Intelligence Committee is closely monitoring what appears to be a significant cybersecurity breach by Chinese intelligence. It’s clear that the PRC is steadily improving its cyber collection capabilities directed against the U.S. and our allies. Close coordination between the U.S. government and the private sector will be critical to countering this threat.”

Microsoft plans to keep improving security around account keys and tokens to stay ahead of evolving cyber risks.

It emphasized the need for continued collaboration and transparency to strengthen defenses across the tech industry against sophisticated hacking campaigns.

Featured image: Koshiro K/Shutterstock

Google To Remove Inactive Accounts via @sejournal, @brookeosmundson

Google updated its inactivity policy for personal Google accounts.

It’s important to note how this could affect business protocols when using a Google account.

Read on to understand the new policy and any measures you should take.

The Policy Update Explained

According to the policy, accounts that haven’t been used or signed in for two years will be deemed an “inactive account.”

Why does this matter?

With the updated Inactive Accounts policy, Google can delete the account and any/all of its contents. This may include:

• Gmail
• Docs
• Drive
• Meet
• Calendar
• YouTube
• Google Photos

It’s important to note that the policy change pertains to personal Google accounts only. Any accounts that are used for businesses or organizations will not be affected.

While the policy takes effect immediately, Google will not delete inactive accounts until December 2023.

Google will start deleting created and never used accounts before moving to other inactive accounts.

Google also noted that it would send multiple notices via email to both the account email address and the recovery email.

Why The Change?

Online security threats continue to be a big issue. While Google invests in technology to protect from account exposure or phishing scams, nothing is foolproof.

Accounts that haven’t been active for extended periods are more vulnerable to being compromised or hijacked. Per Google, these types of funds are more likely to be compromised if:

• Old or re-used passwords have been used
• Two-factor authentication hasn’t been set up
• Fewer security checks by the account owner

With the policy change, Google will start deleting inactive accounts to reduce a user’s risk of account compromise.

Additionally, deleting inactive accounts reduces the amount of personal information Google retains on users, further securing individuals.

So, what is considered an active account?

Google considers an account active if any of the following actions are taken:

• Reading or sending an email through Gmail
• Using Google Drive
• Watching YouTube videos
• Downloading an app on Google Play Store
• Using Google Search (while logged into a Google account)
• Signing into a third-party app via “Sign in with Google.”

What Businesses Need To Know

Many marketers set up Google accounts to tie third-party tools to an account, such as Looker Studio or other reporting tools. These accounts may not be set up as business accounts, which is why this policy update is important.

Here are some helpful tips that marketers can take action on now to ensure a Google account stays active:

• Take inventory of any shared Google accounts used and document them (especially for agencies)
• Log into any Google account and set up two-factor authentication
• Document the dedicated recovery email set up for each account
• Ensure all account settings are up-to-date

This ensures that all necessary information is in place, especially if there is turnover at a business or agency. The accounts can be used over the long term and reduce the impact of setting up new accounts due to a lack of shared internal information.

Summary

A standard process and documentation for accounts are vital for workplace (and personal) security.

Reduce the risk of dealing with an inactive account, or worse – a compromised account – by taking the actions above to ensure any pertinent Google accounts stay active and secure.

Featured Image: Iana Alter/Shutterstock

Google Strikes Back: A Legal Victory Against CryptBot Malware Distributors via @sejournal, @MattGSouthern

Google is ramping up its efforts to combat cybercrime, as the tech giant recently announced a legal victory against the distributors of the notorious CryptBot malware.

Crackdown On Cybercriminals

In the latest move in its ongoing campaign against cybercriminals, Google has successfully filed a civil action against malware distributors responsible for CryptBot, a type of malicious software designed to steal sensitive information from users’ computers.

Google estimates that CryptBot has infected approximately 670,000 computers in the past year alone, primarily targeting users of Google Chrome.

A Southern District of New York federal judge unsealed the civil action. It represents Google’s continued commitment to disrupting cybercriminal ecosystems that seek to exploit online users.

This follows Google’s success last year in holding operators of the Glupteba botnet accountable.

Understanding CryptBot Malware

CryptBot, classified as an “infostealer,” can identify and extract sensitive data from victims’ computers, including authentication credentials, social media account logins, cryptocurrency wallets, and more.

The stolen data is then harvested and sold to bad actors for use in data breach campaigns.

Cybercriminals distributing CryptBot have been offering maliciously modified versions of popular software packages, such as Google Earth Pro and Google Chrome, to unsuspecting users.

The malware is designed to target users of Google Chrome, prompting Google’s CyberCrimes Investigations Group (CCIG) and Threat Analysis Group (TAG) to take action against the distributors.

Legal Strategy & Disruption

Google’s litigation targeted several major distributors of CryptBot, believed to be based in Pakistan and operating a worldwide criminal enterprise.

The legal complaint includes claims of computer fraud and abuse and trademark infringement.

To hinder the spread of CryptBot, the court granted a temporary restraining order that allows Google to take down current and future domains associated with the malware’s distribution.

This measure is expected to slow new infections and decelerate the growth of CryptBot while establishing legal precedent and placing those profiting from criminal activities under scrutiny.

Protecting Against Malware

As part of its efforts to protect users from cyber threats, the Cybercrime Support Network recommends several steps that individuals can take to safeguard themselves against malware like CryptBot:

• Download from trusted sources, such as official websites or app stores, and heed Chrome Safe Browsing warnings.
• Conduct research and read reviews before downloading any software.
• Consistently update your operating system and any software you use, including installing security patches and fixing bugs.

A Glimpse Into What’s Next

Google’s recent lawsuit against the distributors of CryptBot malware marks a meaningful stride toward bringing cybercriminals to justice.

By taking legal action against both those who operate botnets and those who financially benefit from spreading malware, Google is working to improve the security of internet users.

Google has voiced its dedication to this objective and intends to continue these efforts.

Featured Image: Eviart/Shutterstock

Source: Google

Rackspace Hosted Exchange Outage Due to Security Incident via @sejournal, @martinibuster

Rackspace hosted Exchange suffered a catastrophic outage beginning December 2, 2022 and is still ongoing as of 12:37 AM December 4th. Initially described as connectivity and login issues, the guidance was eventually updated to announce that they were dealing with a security incident.

Rackspace Hosted Exchange Issues

The Rackspace system went down in the early morning hours of December 2, 2022. Initially there was no word from Rackspace about what the problem was, much less an ETA of when it would be resolved.

Customers on Twitter reported that Rackspace was not responding to support emails.

This has been quite the day with #Rackspace. Every hosted exchange client has been down for 14 hours or so. Support isn’t reading/responding to tickets. Updates are unhelpful.

I am concerned now that they fell victim to something bad like the ProxyNotShell PoC hack. https://t.co/jchKsAO3Z7

— Joe Sinkwitz (@CygnusSEO) December 2, 2022

A Rackspace customer privately messaged me over social media on Friday to relate their experience:

“All hosted Exchange clients down over the past 16 hours.

Not sure how many companies that is, but it’s significant.

They’re serving a 554 long delay bounce so people emailing in aren’t aware of the bounce for several hours.”

The official Rackspace status page offered a running update of the outage but the initial posts had no information other than there was an outage and it was being investigated.

The first official update was on December 2nd at 2:49 AM:

“We are investigating an issue that is affecting our Hosted Exchange environments. More details will be posted as they become available.”

Thirteen minutes later Rackspace began calling it a “connectivity issue.”

“We are investigating reports of connectivity issues to our Exchange environments.

Users may experience an error upon accessing the Outlook Web App (Webmail) and syncing their email client(s).”

By 6:36 AM the Rackspace updates described the ongoing problem as “connectivity and login issues” then later that afternoon at 1:54 PM Rackspace announced they were still in the “investigation phase” of the outage, still trying to figure out what went wrong.

And they were still calling it “connectivity and login issues” in their Cloud Office environments at 4:51 PM that afternoon.

Rackspace Recommends Migrating to Microsoft 365

Four hours later Rackspace referred to the situation as a “significant failure”and began offering their customers free Microsoft Exchange Plan 1 licenses on Microsoft 365 as a workaround until they understood the problem and could bring the system back online.

The official guidance stated:

“We experienced a significant failure in our Hosted Exchange environment. We proactively shut down the environment to avoid any further issues while we continue work to restore service. As we continue to work through the root cause of the issue, we have an alternate solution that will re-activate your ability to send and receive emails.

At no cost to you, we will be providing you access to Microsoft Exchange Plan 1 licenses on Microsoft 365 until further notice.”

Rackspace Hosted Exchange Security Incident

It was not until nearly 24 hours later at 1:57 AM on December 3rd that Rackspace officially announced that their hosted Exchange service was suffering from a security incident.

The announcement further revealed that the Rackspace technicians had powered down and disconnected the Exchange environment.

Rackspace posted:

“After further analysis, we have determined that this is a security incident.

The known impact is isolated to a portion of our Hosted Exchange platform. We are taking necessary actions to evaluate and protect our environments.”

Twelve hours later that afternoon they updated the status page with more information that their security team and outside experts were still working on solving the outage.

Was Rackspace Service Affected by a Vulnerability?

Rackspace has not released details of the security event.

A security event generally involves a vulnerability and there are two severe vulnerabilities currently in the wile that were patched in November 2022.

These are the two most current vulnerabilities:

• CVE-2022-41040
  Microsoft Exchange Server Server-Side Request Forgery (SSRF) Vulnerability
  A Server Side Request Forgery (SSRF) attack allows a hacker to read and change data on the server.
• CVE-2022-41082
  Microsoft Exchange Server Remote Code Execution Vulnerability
  A Remote Code Execution Vulnerability is one in which an attacker is able to run malicious code on a server.

An advisory published in October 2022 described the impact of the vulnerabilities:

“An authenticated remote attacker can perform SSRF attacks to escalate privileges and execute arbtirary PowerShell code on vulnerable Microsoft Exchange servers.

As the attack is targeted against Microsoft Exchange Mailbox server, the attacker can potentially gain access to other resources via lateral movement into Exchange and Active Directory environments.”

The Rackspace outage updates have not indicated what the specific problem was, only that it was a security incident.

The most current status update as of December 4th stated that the service is still down and customers are encouraged to migrate to the Microsoft 365 service.

Rackspace posted the following on December 4, 2022 at 12:37 AM:

“We continue to make progress in addressing the incident. The availability of your service and security of your data is of high importance.

We have committed extensive internal resources and engaged world-class external expertise in our efforts to minimize negative impacts to customers.”

It’s possible that the above noted vulnerabilities are related to the security incident affecting the Rackspace Hosted Exchange service.

There has been no announcement of whether customer information has been compromised. This event is still ongoing.

Featured image by Shutterstock/Orn Rin

Google Shares New Info About Vulnerabilities Found In Chrome via @sejournal, @MattGSouthern

Google security researchers are sharing new information about vulnerabilities detected in Chrome, Firefox, and Windows.

In a blog post, Google and Threat Analysis Group (TAG) detail steps taken since discovering a commercial spyware operation with ties to Variston IT.

Based in Barcelona, Spain, Variston IT claims to provide custom security solutions. However, the company is connected to an exploitation framework called “Heliconia.”

Heliconia works in three ways:

• It exploits a Chrome renderer bug to run malware on a user’s operating system.
• It deploys a malicious PDF document containing an exploit for Windows Defender.
• It utilizes a set of Firefox exploits for Windows and Linux machines.

The Heliconia exploit was used as early as December 2018 with the release of Firefox 64.

New information released by Google reveals Heliconia was likely used in the wild as a zero-day exploit.

Heliconia poses no risk to users today, as Google says it cannot detect active exploitation. Google, Mozilla, and Microsoft fixed the bugs in early 2021 and 2022.

Although Heliconia is patched, commercial spyware is a growing problem, Google says:

“TAG’s research underscores that the commercial surveillance industry is thriving and has expanded significantly in recent years, creating risk for Internet users around the globe. Commercial spyware puts advanced surveillance capabilities in the hands of governments who use them to spy on journalists, human rights activists, political opposition and dissidents.”

To protect yourself against Heliconia and other exploits like it, it’s essential to keep your internet browsers and operating system up to date.

TAG’s research into Heliconia is available in Google’s new blog post, which Google is publishing to raise awareness about the threat of commercial spyware.

Source: Google

Featured Image: tomfallen/Shutterstock