Posts - Intrucept

11 Million Affected: Widespread of the Necro Trojan in Android Apps

Overview

In September 2024, Kaspersky reported a widespread attack involving the Necro Trojan, which has potentially infected around 11 million Android devices globally. This sophisticated malware primarily targets users downloading modified versions of popular applications such as Spotify, WhatsApp, and Minecraft, as well as certain apps available on Google Play.

Necro Trojan

The Necro Trojan is a type of malware that acts as a loader, meaning it can download and execute additional malicious components once it infiltrates a device. Initially discovered in 2019, the Trojan has evolved, integrating advanced features that enhance its evasion techniques and capabilities. The Trojan cleverly hides its malicious payload within seemingly innocuous images, making it difficult to detect using traditional security methods. This technique allows the malware to bypass standard security checks.

Once activated, the Necro loader can:

Download and execute DEX files, which are compiled Android code.
Install additional malicious applications on the device without user consent.
Intercept sensitive information and transmit it to a command and control (C2) server operated by the attackers.
Display and interact with advertisements in invisible windows, potentially generating revenue for the attackers.
Open arbitrary links and execute JavaScript code, which can further compromise user security.

Affected Applications

The Necro Trojan has been found embedded in various applications, both from unofficial sources and Google Play.

“Spotify Plus” which is marketed as a free, premium version, it contained the Necro Trojan within its code. Users were enticed to download it from unofficial sources, unknowingly risking their devices.
Wuta Camera, which is the popular photo editing app was infected in version 6.3.2.148.
Max Browser in version 1.2.0.
Mods for WhatsApp and popular games like Minecraft, Stumble Guys, Car Parking Multiplayer etc have also been identified as carriers of the Necro loader.

Remediation

To effectively guard against the Necro Trojan and similar threats, users are advised to take the following actions

Wuta Camera, upgrade to version 6.3.7.138 or latest version immediately.
Ensure all apps are updated to the latest versions.

General Recommendations

Avoid unofficial sources for downloading any software.
Implement mobile security solutions that provide real-time and regular scanning to detect and neutralize threats.
Before downloading an app, review its ratings and feedback—watch for suspiciously high ratings and consider low-rated reviews for potential issues.
Always stay updated on emerging vulnerabilities & threats.

References

https://securelist.com/necro-trojan-is-back-on-google-play/113881/

Critical RCE Vulnerability Patched in Ivanti Endpoint Manager (CVE-2024-29847)

Summary

OEM	Ivanti
Severity	Critical
Date of Announcement	2024-09-13
CVSS Score	9.8
CVE	CVE-2024-29847
CWE	CWE-502
Exploited in Wild	Yes
Patch/Remediation Available	Yes
Advisory Version	1.0

Overview

A critical vulnerability (CVE-2024-29847) has been identified in Ivanti Endpoint Manager, allowing unauthenticated attackers to execute arbitrary code remotely. This flaw is due to a deserialization of untrusted data issue in the AgentPortal.exe service, specifically within the .NET Remote framework. Exploitation can allow attackers to perform file operations such as reading or writing files on the server, potentially leading to full system compromise.

Vulnerability Name	CVE ID	Product Affected	Impact	CVSS Score
Ivanti RCE (Remote code execution) Vulnerability	CVE-2024-29847	Ivanti Endpoint Manager (EPM) versions prior to 2022 SU6 and 2024 September updates	Critical	9.8

Technical Summary

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2024-29847	Ivanti Endpoint Manager (EPM) versions prior to 2022 SU6 and 2024 September updates	The AgentPortal.exe service's insecure deserialization, notably in the On Start method that makes use of the antiquated Microsoft.NET Remoting framework, is the source of the vulnerability. Without any security enforcement, the service registers a TCP channel that makes it possible for attackers to inject malicious objects. Attackers can initiate file operations, such as reading, writing, or even executing arbitrary code on the server for example, launching web shells for remote code execution by transmitting a crafted hash table of serialized objects.	Remote Code Execution (RCE)

Remediation

Ivanti has released security updates addressing this vulnerability. Apply the latest patches for Ivanti EPM immediately:

Ivanti EPM 2022 SU6
Ivanti EPM September 2024 Update

General Recommendations:

Conduct regular vulnerability scans to ensure that all systems are up-to-date, and no vulnerable versions are in use.
Ensure that systems and users only have the minimum required access levels to reduce the impact of any compromise.
Segregate critical systems from the rest of the network to minimize potential damage from a successful exploitation.

References

Critical SonicWall Firewall Vulnerability Exploited in Ransomware Attacks

Summary

OEM	SonicWall
Severity	Critical
Date of Announcement	2024-09-06
CVSS Score	9.3
CVE	CVE-2024-40766
CWE	CWE-284
Exploited in Wild	Yes
Patch/Remediation Available	Yes
Advisory Version	1.0

Overview

A critical vulnerability in SonicWall SonicOS management access and SSLVPN, tracked as CVE-2024-40766, has been identified and potentially exploited in ransomware attacks. The vulnerability affects SonicWall firewalls (Gen 5, Gen 6, and Gen 7) and involves improper access control, which could allow unauthorized resource access or trigger a firewall crash. The Akira and other ransomware group is suspected of using this flaw to gain initial access to compromised systems.

Vulnerability Name	CVE ID	Product Affected	Impact	CVSS Score
SonicOS Improper Access Control Vulnerability	CVE-2024-40766	SOHO (Gen 5), Gen6 Firewalls, Gen7 Firewalls (Detailed table in Remediation)	Critical	9.3

Technical Summary

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2024-40766	Affects SonicWall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.	The SonicWall SSLVPN vulnerability (CVE-2024-40766) involves an improper access control issue within SonicOS, specifically targeting the management access and SSLVPN functionality of the firewall. This flaw allows an unauthenticated attacker to gain unauthorized access to critical resources or cause a firewall crash by bypassing security restrictions.	Potential unauthorized access to SonicWall firewalls, leading to resource exposure or system crashes.

Remediation

SonicWall has released patches to address CVE-2024-40766. Organizations are urged to apply these patches immediately to mitigate the risk of exploitation.
Here is the below table for fixed Platforms with the impacted versions along with fixed versions:

Impacted Platform	Impacted Versions	Fixed Versions
SOHO (Gen 5)	5.9.2.14-12o and older versions	5.9.2.14-13o
Gen6 Firewalls	6.5.4.14-109n and older versions	6.5.2.8-2n (for SM9800, NSsp 12400, NSsp 12800) 6.5.4.15.116n (for other Gen6 Firewall appliances)
Gen7 FirewallsGen7 Firewalls	SonicOS build version 7.0.1-5035 and older versions. However, SonicWall recommends you install the latest firmware.	This vulnerability is not reproducible in SonicOS firmware version higher than 7.0.1-5035. However, SonicWall recommends you install the latest firmware.

General Recommendations:

Limit management and SSLVPN access to trusted sources and disable WAN management portal internet access as an additional safeguard.
SonicWall strongly advises that customers using GEN5 and GEN6 firewalls with SSLVPN users should update their credentials as a precaution.
Enforce multi-factor authentication (MFA) for all SSLVPN users to reduce the risk of unauthorized access.
Continuously monitor for signs of compromise, especially for abnormal activities related to SonicWall devices.
Regularly monitor for suspicious login attempts from unusual locations or IP addresses, and block any that are identified.
Additionally, if there is any unauthorized access to the SonicWall management interface, take steps to block those access points as well.

References

https://psirt.global.sonicwall.com/vuln-list

Social login flaws put billions of users at risk of account takeover

Flaws in social login mechanisms are leaving thousands of websites and a billion of their users vulnerable to account takeovers, API security company Salt Security warns. The latest research by Salt Security identified flaws in the access token verification step of the social sign-in process, part of the OAuth implementation on these websites.

Cisco Zero-Day Exploited to Implant Malicious Lua Backdoor

Cisco has identified a critical security issue affecting its IOS XE software, specifically a zero-day vulnerability tracked as CVE-2023-20273 with a CVSS score of 7.2. This flaw is actively exploited by unknown threat actors to deploy a malicious Lua-based implant on vulnerable devices. Additionally, this zero-day was utilized in conjunction with CVE-2023-20198 (CVSS score: 10.0) to create an exploit chain.

Urgent Security Alert: Indian Government Warns iPhone and iPad Users to Update Immediately

In today’s digital age, our smartphones have become an essential part of our lives. They store sensitive information, offer access to personal accounts, and play a vital role in communication. As a result, it is crucial to stay updated on the latest security advisories, especially for mobile devices.

New WordPress Backdoor Threatens Website Security: A Closer Look

The world of cybersecurity is constantly evolving, and so are the threats to websites and online platforms. In a recent discovery, a dangerous new malware has emerged, camouflaging itself as a legitimate caching plugin, specifically targeting WordPress websites. This insidious backdoor has the potential to wreak havoc by creating rogue administrators, taking control of websites, and undermining both user privacy and SEO rankings. This blog post will delve into the details of this new threat, its disguise, and its capabilities.

Critical Government Alert: Protecting Android 13 and Older Devices – Risks, Affected Devices, and Security Measures

In a world where our smartphones have become an essential part of our lives, it is crucial to ensure their security. Recently, the Indian government issued a critical warning for Android users, particularly those using Android versions 13 and older. This warning is significant, given the large number of Android users in India.

Strengthening Cyber Defense: NSA and CISA Unveil Top Ten Cybersecurity Misconfigurations

Cybersecurity is a top priority for organizations of all sizes, as cyber threats continue to evolve at an unprecedented pace. In response to this ever-changing landscape, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have released a joint cybersecurity advisory (CSA) highlighting the top ten cybersecurity misconfigurations that leave organizations vulnerable to attack.

Apple’s Swift Response: Emergency Update Zero-Day Vulnerabilities Exploiting iPhones

Apple has released an emergency security update to address two newly discovered zero-day vulnerabilities that have been actively exploited to attack iPhones and iPads.Apple has not confirmed any in-the-wild exploitation of the libvpx bug, but it is worth noting that Google and Microsoft have previously patched it as a zero-day in their products.The latest security update is available for all devices running iOS 17.0.3 and iPadOS 17.0.3 or later. Apple urges all users to install the update as soon as possible.