pwnkit — Black Arrow Cyber Consulting

Black Arrow Cyber Threat Briefing 01 July 2022

Black Arrow Cyber Threat Briefing 01 July 2022:

-Ransomware Is the Biggest Global Cyber Threat. And The Attacks Are Still Evolving

-Study Reveals Traditional Data Security Tools Have a 60% Failure Rate Against Ransomware and Extortion

-Patchable and Preventable Security Issues Lead Causes of Q1 Attacks

-Three in Four Vulnerability Management Programs Ineffective, NopSec Research Finds

-EMEA Continues to Be a Hotspot for Malware Threats

-A New, Remarkably Sophisticated Malware Is Attacking Home and Small Office Routers

-What Are Shadow IDs, and How Are They Crucial in 2022?

-Zero-Days Aren't Going Away Anytime Soon & What Leaders Need to Know

-Half of 2022's Zero-Days Are Variants of Previous Vulnerabilities

-Human Error Remains the Top Security Issue

-Carnival Cruises Torpedoed by US States, Agrees to Pay $6m After Wave of Cyber Attacks

-Uber Ex-Security Chief Accused of Hacking Coverup Must Face Fraud Charges, Judge Rules

Black Arrow AdminJuly 3, 2022lindy cameron, titaniam, tetra defense, nopsec, emotet, watchguard, threatlab, cisco, asus, netgear, draytek, zuorat, soho, routers, mirai, jpmorgan, follina, google project zero, webkit, petitpotam, atlassian confluence, sans, carnival cruise lines, uber, us department of justice, notpetya, astralocker, mitel, mitel voip, black basta, lockbit, qakbot, printnightmware, conti, kaseya, macmillan publishing, walmart, yanluowang, ransomhouse, amd, netwalker, evilnum, matanbuchus, ukraine, xfiles, discord, minors, pypi, pythin, revive, revive spyware, hermit, hermit spyware, california, gun owners, pentagon, santander, ruja ignatova, singapore, hackerone, shadow id, digital shadows, pwnkit, zola, raccoon stealer, ytstealer, youtube, facebook, twitter, snoopers charter, manx government, g7, tiktok, killnet, lazarus, adaudit, manageengine, azure, openssl, unrar, jenkins, log4shell, shadowpad, codesys, solarwinds, lgbt, lgbtq+, tencent, qr codes, wifi networks, black arrow, black arrow cyber, cyber experts, cyber consulting, cyber investigators, cyber, cyber security, infosec, information security, threat intel, threat intelligence, threat report, business risk, business risks, cyber risk management, risk management, cyber risk, cyber security risk, cyber risk assessment, risk assessment, cyber incident response, cyber incident response team, cyber emergency response, computer incident response, computer emergency response, emergency response, subject matter experts, it security, trusted adviser, trusted partner, vciso, virtual chief information security officer, viso, information security officer, security executive on demand, security as a service, security on demand, cyber security strategy, cyber strategy, cyber kill chain, security as a a service, security-as-a-service, british intelligence, national security, uk national security, military intelligence, mod, ministry of defence, police, law enforcement, ftse 100, ftse100, offshore financial services, gfsc, guernsey financial services commission, fortune 500, fortune500, ncsc, national cyber security centre, cpni, mi5, gchq, cert, cert-uk, cert.gg, five eyes, cyber guernsey, guernsey cyber, nca, national crime agency, europol, interpol, enisa, nato, australian cyber security centre, acsc, canadian centre for cyber security, cccs, new zealand national cyber security centre, ncsc-nz, cybersecurity and infrastructure agency, cisa, national security administration, nsa, federal bureau of investigation, fbi, central intelligence agency, cia, department of homeland security, dhs, secret service, odpa, office of the data protection authority, ico, information commissioners office, isc2, isaca, sme, smb, small business, medium sized business, accounting, law firms, legal sector, academia, education, schools, retail, maritime, aviation, aerospace, transport, defence, defense, defence contractor, cni, scada, ics, industrial control systems, operational technology, ot, healthcare, medical, pharma, pharmaceuticals, pci-dss, payment card, payment card industry, estate agents, estate agency, child safety, parental controls, regulated firms, financial services, critical infrastructure, mergers and acquisitions, manda, m&a, research and development, r&d, intellectual property, ip, telecoms, telecommunications, executives, executive, insiders, insider threat, staff, users, end users, senior executives, c-suite, boards, human element, human centric security, human centric, weakest link, boardroom, board room, ciso, ceo, cto, cio, nist, cyber essentials, cyber essentials plus, iasme, iasme governance, iasme gold, iso 27001, iso27001, cyber killchain, mitre, mitre att&ck, cis, cis controls, cap1753, cap 1753, caa, civil aviation authority, fraud investigations, forensics, cyber forensics, forensic investigations, expert witness, technical investigations, apt, china, russia, iran, north korea, nation state actors, ransomware, bec, business email compromise, email, social engineering, phishing, spear-phishing, whaling, credentials, credential stuffing, account takeover, account takeovers, ato, extortion, blackmail, denial of service, distributed denial of service, dos, ddos, rddos, botnet, cryptomining, cryptojacking, rootkits, rootkit, shadow it, remote code execution, rce, zero-day, malware, vishing, smishing, heat attacks, heat, highly evasive adaptive threats, rat, remote access trojan, cyber bullying, cyber stalking, sextortion, blockchain, vulnerability, vulnerabilities, vulnerability management, patch management, patching, kev, kevs, known exploited vulnerabilities, insurance, cyber insurance, incident response, incident response plan, disaster recovery, disaster recovery plan, drp, business continuity, business continuity planning, business continuity plan, training, education and awareness training, awareness, exercising, exercise, proctored exercise, facilitated exercise, simulations, gap analysis, cyber gap analysis, board upskilling, senior executive cyber risk and governance, senior executive cyber risk and governance workshops, technical assessment, technical analysis, penetration testing, pentesting, physical penetration testing, tas, targeted attack simulations, iso 27001 iso27001, technical IT security, iam, idam, identity and access management, digital transformation, change management, hackers, criminals, cyber criminals, cyber warfare, espionage, cyber espionage, fraudsters, fraud, scammers, scams, scam, organised crime, criminal actor, criminal actors, terrorism, terrorists, cyber terrorists, cyber terrorism, supply chain, third parties, mssp, msp, managed service provider, managed security service provider, external it provider, internal it, apple, mac, macos, ios, iphone, android, microsoft, windows, cloud, saas, iaas, paas, dark web, databases, encryption, cryptocurrencies, iot, ai, endpoint protection, antivirus, antimalware, wfh, work from home, dns, email gateway, gdpr, online, open source, attack surface, edr, mdr, xdr, monitoring and detection andorra, anguilla, antigua and barbuda, aruba, bahamas, barbados, bermuda, british virgin islands, bvi, cayman islands, channel islands, ci, cyprus, dominica, dublin, dutch antilles, gibraltar, grenada, guernsey, isle of man, jersey, liechtenstein, london, luxembourg, malta, monaco, netherlands antilles, philippines, st kitts and nevis, st lucia, st vincent and grenadines, switzerland, turks and caicos islands, scotland, edinburgh, glasgow, bristol, southampton, portsmouth, exeter, europe, offshore, south west, south east, uk, england, great britain, british isles

Black Arrow Cyber Advisory – “PwnKit” Bug Allows Root Access on the Ubiquitous Linux Operating System

Black Arrow Cyber Advisory – “PwnKit” Bug Allows Root Access on the Ubiquitous Linux Operating System

Executive Summary

Security researchers have revealed a new toolkit bug in the Linux operating system, the software that drives most of the world. Linux is found everywhere, from firewalls and network switches to cars and huge industrial machines. The tool, ‘pkexec’, was found to be vulnerable to privilege escalation, allowing an attacker to gain root or administrator privileges with ease.

What’s the risk to me or my business?

As Linux runs in almost every environment in the world, an attacker with access to the system could exploit the vulnerability to take control. The attack can become particularly potent when used in combination with other exploits on an unpatched system. Security researchers note the attack is ‘trivially exploitable’, leading to a dangerous situation if a system is indeed susceptible.

What can I do?

A patch has been issued for the bug, which should be implemented as soon as possible on any device that may be running Linux. It is recommended that systems in general be patched as often as practicable to reduce overall risk.

Technical Summary

Security researchers have disclosed a buffer overflow attack in Polkit, a tool allowing programs without special privileges to run safely with services requiring root. The bug exploits environment variables, allowing an attacker to use NULL references to craft the overflow. As a result a malicious user could, even on an account with minimal privileges, use the misalignment to introduce dangerous environment variables to elevate their session.

Need help understanding your gaps, or just want some advice? Get in touch with us.

Black Arrow AdminJanuary 27, 2022black arrow cyber, black arrow, threat intelligence, threat advisory, alert, pwnkit, linux, root

Blog