Hello and welcome to the Decipher Podcast.
I'm Dennis Fisher. Lindsay is travelling this week,
so it's just me talking into a microphone.
It was another busy week in security.
So there were a few quick things that I wanted to mention just to
get them on the record for this week.
So we talked about last week this CLOP extortion campaign
that was targeting customers of Oracle's e-business Suite with
some extortion emails that were sort of varied in the amount of
money they were asking for and the amount of or the kinds of
data that the attacker said that they had.
A lot of times it was customer data or even HR and payroll data
for the internal employees of the victim organization.
Some of the ransom demands that we saw were upwards of in the
10s of millions of dollars. And this just started to get
publicized last week. But we found out earlier this
week that it turns out that this campaign went much farther back
than that. Google and Mandy and put out
some interesting research towards the end of the week that
showed that the attacks actually started back in July.
So this has been going on for the better part of three months
now. It's not clear whether the
extortion demands only started in the in the last couple weeks
and that's why this became public.
What the Google researchers say is that the campaign and the
data thefts intrusions were, were happening back in the
summer, back in July and August. So it may be just that the
emails started in the, in the, you know, more recent time
frame. And that's why everybody started
hearing about it once some executive started to come
forward with this. But I thought it was interesting
that this has been going on for several months before it became
public knowledge. A lot of times there are smaller
scale campaigns like these that go under the radar because
they're not targeting high profile companies or they're not
targeting high profile applications and they're not
widespread enough to really gain huge notice.
But the Oracle e-business Suite obviously is used by a lot of
large organizations. And these attacks that
apparently began as as early as about mid-july, I think they say
July 10, you know, when this vulnerability in, in E-business
Suite was a zero day. This is obviously you got plenty
of attention. It's a large, large customer
base, plenty of targets, potential victims.
So the attackers had, you know, plenty of time to get their
their act together and get this rolling before anybody really
noticed it. And I think Mandiant said that
the threat actor was likely exploiting this vulnerability as
early as August 9th. So that was several weeks before
this patch was available, which was only very recently.
So the window of exposure for this vulnerability was pretty
large and there are still many, many exposed instances of
e-business Suite out there. Gray Noise has some good data on
this if you want to go look at that.
So this is something that's ongoing and we know now is was
going on for a couple of months before everybody really noticed
it, which is kind of concerning, especially when you think about
the potential for follow on attacks and ransomware
deployments that could come from this.
You know, we may only sort of be at the at the beginning of this,
but hopefully the public notice of this and the public or the
publicity surrounding it will drive some more patching and
more awareness and get organizations to really pay
attention to it. That at least that's the that's
the hope. Another story that I wanted to
mention that has some interesting connections to some
previous work that we did on the site is Gray Noise released some
data towards the end of this week as well about some surges
in scanning for Fortinet, Palo Alto Networks and Cisco devices
in for various reasons. If you remember, Cisco notified
customers about two zero day vulnerabilities that were being
exploited in their ASA appliances.
Recently, you know attackers have been targeting those very
popular product. So plenty of attacks surface
there and so there's been ongoing scanning for that.
And at the same time, Grain always noticed some pretty large
upticks in scanning for various Fortinet and Palo Alto network
instances. In some cases, they're the
attackers are looking for login portals and trying to brute
force, you know, the logins for these for these products.
This is, you know, kind of a constant thing that happens on
the Internet all the time. And there are various ups and
downs with this all the time. But there's some pretty large
spikes in the scanning for these in the last couple of days.
You know, Gray noises data show like a massive spike in scanning
for Fortinet SSLVPNS in the last couple of days of this week.
So it's one of those things that organizations should definitely
be aware of. If you're deploying these
devices, you probably are aware of this already, but it's
something to to keep keep in mind.
This kind of activity, as I said, is ongoing almost all the
time. And it, you know, it has its ups
and downs based on, you know, new disclosures, various
vulnerabilities, or just kind of when attackers feel like getting
around to it when they don't have other priorities.
But it's definitely something to keep in mind if you're using
these devices. And as I said, there were also
spikes for Palo Alto network scanning as well.
So these are things just to to keep in mind as you're going
about your, your work. And kind of the last thing I
wanted to mention, describe my attention towards the end of the
week as well. Apple put out a relatively rare
blog post. They don't.
They don't do very much on the Internet, as everybody knows,
especially in the security world.
They're pretty, pretty tight with their words when it comes
to their security work and the way that they handle
vulnerability disclosure and various other things.
But they released a long blog post on Friday morning
describing some changes and modifications to their bug
bounty program. And I would encourage everybody
to go read it if you're interested in bug bounties and
the way that companies handle vulnerability disclosure and
encourage research on their products, which can vary widely
from vendor to vendor. As I'm sure you all know, it can
vary from actively discouraging researchers to to disclose
vulnerabilities to actively encouraging it and offering
large bug bounties. And there's a broad middle
ground there. A lot of security companies and
other tech companies are kind of in that middle ground.
Apple was has had a bug bounty program in various forms for
quite a while. It wasn't the broadest one at
the beginning. It was relatively narrow and
it's still not super broad, but they announced some really large
payout changes to what they do have.
So previously they had had some, even the previous payouts were
very large. Let's be clear about that.
Apple pays a lot of money for significant vulnerability
disclosures that fit their their parameters.
So the highest level they had previously was a win $1 million
maximum payout and that was for a zero click exploit chain.
So, you know, a remote compromise of a device with no
user interaction. These are the kinds of attack
chains that you see from mercenary spyware vendors.
These are the things that those companies pay very large amounts
of money for and also develop themselves in a lot of cases,
but sometimes they buy them from third parties as well.
So Apple is doubling that maximum bug bounty to $2,000,000
for a zero click chain, which is an enormous amount of money
obviously. And I'm not aware of any other
bug bounty that that is that high, at least not a public one.
There may be them, but I'm not aware of them.
And Apple also changed several other of their payouts.
So for a one click exploit chain, you know, which just
takes one small user interaction, the previous
maximum was 250K. That's gone up to $1,000,000.
Wireless proximity attack, you know, where you need to be
within, you know, sort of close physical proximity of the target
device. That also went up from 250K to
$1,000,000. An attack with that requires
physical device access to a lock device.
It goes from 250K to 500K. You know, still a huge amount of
money and an app sandbox, sandbox escape, easy for me to
say, goes from 150K to 500K. These are obviously huge amounts
of money, and obviously Apple has a huge amount of money and
they can afford this. And what's interesting to me,
obviously the money is interesting, but the other part
that really grabs my attention and should be something that
outside researchers should look at is where Apple is choosing to
invest this money in these specific areas is a pretty good
indicator of where they're seeing attackers invest their
time and money. They know how the mercenary
spyware vendors operate, what parts of iOS they typically have
success targeting with their exploit chains.
And that's where Apple is focusing a lot of their
attention because that's where those are the exploit attempts
or and actual exploit successes that get the most attention from
vendors like Apple, because those are the ones that are the
most difficult to find in the wild and also the most difficult
to defend against because they typically come from extremely.
You know, I hate the word sophisticated because it's it's
kind of a catch all in the security world.
But you're talking about the top tier of adversaries that have
large budget, large budgets, a lot of technical resources, time
and other things to invest in these things.
So they know what they're doing is the bottom line.
So Apple is focusing their attention on these parts of iOS
to harden those. And it's also a good indication
of where Apple thinks there's things that maybe they haven't
found and maybe outside researchers can find.
There might be a soft spot that maybe they overlooked and maybe
the researchers can get to. So there's a, there's a ton of
money at stake here. And obviously they don't, these
are not rewards that they're going to be paying out on a very
frequent basis. You know, they're, they're rare
enough that when they do pay them out, you, you probably hear
about them. But I think it's an interesting
change from Apple because, as I said, they're often not very
public about what they do, especially when it comes to
device and operating system security.
So it's something to pay attention to when they do make a
change like this. So just one of those things I
wanted to flag for everybody. There's also a bunch of
different, other changes that they're making to the program as
well For Mac OS Gatekeeper, they're offering some new
bounties there as well in, in some different bounty category.
So it's worth everybody checking it out.
I'll, I'll put the link in the show notes so folks can go go
check it out. But those, those dollar figures
really grab my attention. Even for a company like Apple,
putting a $2,000,000 maximum bounty on something is not
something that they would do lightly.
So it's worth having a look at. Anyway, that's it for this week.
Thank you all for for listening. And Oh yeah, or, or just to
update everybody on the the new weekly segment.
Does Dennis have a dog yet? No, I do not.
Still very sad, but maybe one day.
But thanks everybody for listening.
Have a great week.