July has brought to light malicious use of an older version of the ChatGPT engine and a previously used filename trick, along with several security issues impacting everyone from business to government, and ‘at home’ consumers.
New/Improved Techniques
WormGTP – Malicious Generative AI
WormGPT is a malicious chatbot that does not have any safety controls in place and will not hesitate to answer any question a user enters. WormGPT was initially sold on HackForums, a community known for hosting an active marketplace for cybercrime tools and services.
As WormGPT is based on the now two-year-old GPT-J LLM (large language model), it lacks the ability to produce convincing written language on the same scale as GPT-3 and GPT-4 models. The phishing emails this chatbot is able will be hard to distinguish from what we already see being used to target users, and does not represent a great leap forward in this area. While the older LLM based generative AI are more adept at producing code than convincing English, they also lack the same open-source development functionality and are restricted to certain parameters – meaning we aren’t expecting any AI generated novel attack vectors for the time being, but this is a space to keep an eye on.
Right-to-left Override
Some adversaries have started to re-use a technique that utilises a specific Unicode character to trick users into executing a file with a disguised extension. This has been found in a recent phishing campaign, where the files were presented as voicemail attachments.
The attack uses the Unicode character [U+202e], which was designed to allow right-to-left written languages to function with the Unicode character set and reverses the order of any characters that appear after the specific character. For example, a file called voicemail[U+202e]3pm.html will appear as voicemaillmth.mp3 – and although the computer will correctly recognise the file type, to the user this will look like an audio file, but will open a malicious HTML file.
Although the current campaign utilising this trick is hardly sophisticated and unlikely to pass the robust email filtering technology used in many modern enterprises, the high-volume nature of these attempts will certainly lead to some users opening the malicious files.
Attacks / Threats
[Russia] Midnight Blizzard, Targeted Teams Social Engineering
Microsoft Threat Intelligence has identified a highly targeted social engineering campaign, using credential theft by phishing Microsoft Teams users. The campaign by Russian based threat actor ‘Midnight Blizzard’ uses compromised Microsoft tenants to create new domains to replicate support accounts, then uses these domains to distribute lures and engage users to approve MFA prompts. Microsoft revealed that this current campaign has affected fewer than 40 organisations, but these organisations have been specifically targeted and likely indicated specific espionage objectives from the state-affiliated group.
[Global] Android Patching Delay
Google released their annual 0-day report, highlighting a longstanding issue in the Android ecosystem of 0-day vulnerabilities that take an extended period to patch.
The Android issue arises from complexities in their ecosystem, where downstream manufacturers bundle proprietary versions of the Android operating system with their devices. These manufacturers are also responsible for maintaining and updating these proprietary Android versions, sometimes leading to months of delay before an important security patch can be adequately tested and released to vulnerable devices. The patch gap means that for many users, these vulnerabilities present 0-day levels of risk to their device for an extended period of time – a device that likely contains work emails, and the users vital second factor of authentication.
[US] NetScaler 0-Day
Citrix patched a critical Remote Code Execution (RCE) vulnerability in NetScaler ADC and Gateway that was used to extract Active Directory data from a US critical infrastructure organisation in June.
CISA released information about the attack after a patch had been released and were able to confirm that the attacker had leveraged the RCE to set up a web shell on a non-production NetScaler ADC (application delivery controller) device. The attacker then used this backdoor to enumerate Active Directory objects and extract data from the environment. However, because the organisation had their ADC appliance segregated in their network, the attackers were not able to gain direct access to the domain controller.
Security researchers from the Shadowserver Foundation disclosed in early August that they had discovered over 640 Citrix servers that have been breached and backdoored with the web shell, with another 10,000 devices they still believed to be unpatched and vulnerable.
[US] MOVEit Update
The current number of organisations impacted by the Cl0p MOVEit 0-day has risen to 622, exposing the data of over 40 million individuals. While we don’t currently know what organisations will have paid the extortion fee, IBM have released their yearly ‘Cost of a Data Breach Report’ – which puts the average cost of a data breach at $165 USD per individual – we refused to do the math on this one.
Cl0p have also been releasing their data on clear web sites to make the data more accessible to apply further pressure to individuals/organisations who may lack the ability or willingness to hunt for their data on the dark web. These sites appear to be taken down just as fast as they are stood up, and we are interested to see if this technique gains traction with other adversaries.
[US] BreachForum Users available on ‘Have I Been Pwned’
The tables have been turned for users of the breached cybercrime forum ‘BreachForums’, which was itself the victim of a hack in November last year – with the hackers now sharing the database with ‘Have I Been Pwned’. (‘Have I Been Pwned’ operate a data breach notification service, which will allow users of the forum to know if their credentials have been compromised).
The breach which exposed over 200,000 records for users of the forums, including usernames, IP and email addresses, private messages and passwords, is now for sale as a dataset for $100,000 USD. The adversary has admitted that they supplied the database to ‘Have I Been Pwned’ in an attempt to apply pressure to users of the forum. These users have larger issues however, as it is believed the FBI had longstanding access to the forum before arresting the owner in March of 2023.
[US] Robocallers Fined 300 Million
The Federal Communications Commission (FCC) announced an eye-watering $300 million dollar fine for an international network of companies who made five billion robocalls to 500 million phone numbers over a three-month period in 2021. The international network was run by a pair of known call-scammers, who have both previously received lifetime telemarketing bans from the Federal Trading Commission (FTC) – but no major fines until now.
The pair used spoofing tools to mask their origin, and the organisations violated a number of laws designed to stop automated telemarketing. These calls were so widespread that they became a meme -“I am trying to reach you about your extended warranty”.
[US] Tesla Infotainment Jailbreak
Researchers at the Technical University of Berlin have successfully developed a method to jailbreak the AMD-chipped infotainment system – commonly used in Tesla cars. Previous research from the team into fault injection attacks against AMD’s Zen 1 architecture was utilised, and a known voltage fault injection attack was used to subvert the AMD Secure Processor boot code, then the boot flow was reverse engineered to gain a root shell on the recovery and underlying Linux distribution.
The team were able to access and decrypt user information from the system, migrate the TPM-protected attestation key (the key used to authenticate car) to another vehicle, and fully unlock paid features of the vehicle (such as heated seats). Tesla responded to the disclosure, indicating that this attack was only effective on a depreciated version of their firmware.