There has been an ever-increasing number of vulnerabilities and malware rearing their ugly heads lately. One of the most common things these malware will attempt to do is gain elevated permissions to allow execution of its code without user interaction. Recently, a new vulnerability was found in the popular archival software 7-Zip that can potentially allow just that.
7-Zip is an open source universal compression and archive utility that is meant to work on Unix-like systems, and Windows. The exploit in question takes advantage of the fact that the Windows version of the software utilizes the system's help file format, known as CHM files. These help menu files can still utilize ActiveX controls, a functionality that saw its final release in 2013 and is today considered deprecated. ActiveX has been considered insecure for years by researchers due to its inherent elevated permissions, including direct access to executing shell commands as a privileged user.
When utilizing 7-Zip's help menu, it executes the hh.exe, which can still run and use ActiveX objects. If you attempt to drag a .7z extension file to that window that appears, after malware or an attacker has run their piece to unlock the nasty potential of elevated access, it can potentially open up a command prompt with elevated administrator access. This is displayed in the video made by Kağan Çapar, a security researcher from Turkey.
Kağan does state in his GitHub, which outlines the vulnerability, that he will not publish the details of the exploit until after the issue is patched by the 7-Zip developers. No action has been taken yet, unfortunately. He does, however, go on to say that the bug report has been issued to 7-Zip developers, and that its CVE-2022-29072 designation has been submitted to security reporting web sites.
Screenshot of 7-Zip Bug Report
Of course, the researcher also outlines probably the simplest way to prevent an issue. Just delete the CHM file from your installation of 7-Zip. This will prevent the help menu from opening and just cause any attempts at this to fail. You can also modify what permissions the hh.exe process can operate at, but for most users just deleting the .chm file from the installation directory is easiest.
By Bill Toulas, Bleeping Computer Ukraine's computer emergency response team (CERT-UA) has published an announcement warning of ongoing DDoS (distributed denial of service) attacks targeting pro-Ukraine sites and the government web portal. The threat actors, who at this time remain unknown, are compromising WordPress sites and injecting malicious JavaScript code to perform the attacks. These scripts are placed in the HTML structure of the main files of the website and are base64-encoded to evade detection. The code runs on the website visitor's computer and directs their available computational resources to generate an abnormal number of requests to attack objects (URLs) defined in the code. The result is that some of the target websites are overwhelmed by the requests and, as a result, rendered inaccessible to their regular visitors. This all happens without the owners or the visitors of the compromised sites ever realizing it, except for maybe some barely noticeable performan...
By Lawrence Abrams, Bleeping Computer A recent security update for a Windows NTLM Relay Attack has been confirmed to be a previously unfixed vector for the PetitPotam attack. During the May 2022 Patch Tuesday, Microsoft released a security update for an actively exploited NTLM Relay Attack labeled as a 'Windows LSA Spoofing Vulnerability' and tracked as CVE-2022-26925 . "An unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. This security update detects anonymous connection attempts in LSARPC and disallows it." An NTLM Relay Attack allows threat actors to force devices, even domain controllers, to authenticate against malicious servers they control. Once a device authenticates, the malicious server can impersonate the device and gain all of its privileges. These attacks are significant problems as they could allow a threat actor to gain complete control over the domain. Whi...
By Bill Toulas, Bleeping Computer A malicious campaign targeting Android devices worldwide utilizes thousands of Telegram bots to infect devices with SMS-stealing malware and steal one-time 2FA passwords (OTPs) for over 600 services. Zimperium researchers discovered the operation and have been tracking it since February 2022. They report finding at least 107,000 distinct malware samples associated with the campaign. The cybercriminals are motivated by financial gain, most likely using infected devices as authentication and anonymization relays. Telegram entrapment The SMS stealer is distributed either through malvertising or Telegram bots that automate communications with the victim. In the first case, victims are led to pages mimicking Google Play, reporting inflated download counts to add legitimacy and create a false sense of trust. On Telegram, the bots promise to give the user a pirated application for the Android platform, asking for their phone number before they share the ...
Comments
Post a Comment