May 24, 2019
Home » Internet Security

Internet Security

Cyber Assistant
WordPress finally gets a third of the Internet’s security features
Moseley (Raam) Posted On May 7, 2019


WordPress 5.2 released a modern cryptographic library with support for cryptographic updates.

The Content Management System for WordPress (CMS) today receives a variety of new security features that will eventually add the level of protection many people desire for years.

The official release of WordPress 5.2 is expected to end today with these features.

The includes support for encrypted updates, support for a modern cryptography library, an admin backend site health section and a feature that serves to protect a white-screen-of – the-death (WSOD) website in the event of catastrophic PHP errors.

With WordPress installed on approximately 33.8 percent of all websites, these features make certain fears easier in relation to certain attack vectors.

Cryptography Signed Updates                                                      

Probably the biggest and most important feature of today’s security is the offline WordPress digital signature system.

Starting with WordPress 5.2, the WordPress team will digitally sign its update packages with an Ed25519 public key signature system so that a local installation can verify the authenticity of the update package before using it on a local site.

Adding support for encrypted updates is an important step in avoiding the threat of actors attacking all WordPress websites that security firms have been warning of for over two years.

“We just had to hack[WordPress] update server before WordPress 5.2, if you wanted to infect every WordPress site on the Internet,” said Scott Arciszewski, chairman of the development department of Paragon Initiative Enterprises and one of the developers who helped ensure WordPress updates.

“After WordPress 5.2, you should pull off the same attack and somehow pilfer the key signing WordPress Core Development Team.

WORDPRESS GETS A MODERN LIBRARY CRYPTOGRAPHIC

But the WordPress CMS work of Arciszewski did not end here. He also contributed to replacing WordPress by an old cryptographic library that fits modern times.

Beginning with WordPress 5.2, CMS will support the Libsodium library, instead of a now deprecated and removed mcrypt, for all cryptographic operations.

Libsodium and the Arciszewski sodium compat library are now part of WordPress CMS source code, which works as a polyfill for oldern PHP servers that don’t support Libsodium. Sodium.

WordPress is now amongst modern web-dev tools that support Libsodium natively, like PHP 7.2+, Magento 2.3 +, and Joomla 3.8+.


In addition, with Libsodium’s addition to the WordPress CMS core, it can also be supported by plug-in and theme developers.

Arciszewski today published a blog post with basic advice on how to replace old cryptographical functions with libzodium for WordPress plugin and theme developers.

NEW SITE HEALTH SECTION

However, the first WordPress 5.2 security features users find in today’s release are not modifications to the code of CMS, but the new section on “Site Health” in the Tools menu of the admin panel.

This section contains two new pages-namely health status and health information for the site.

The health status page of the Site works by carrying out a series of basic security checks and reporting the findings along with recommendations to resolve any identified problems.

This section includes a number of bundled tests, but security plugins owners and developers can also write their own to expand safety checks into more areas of a WordPress website.

Image: Marius L. J.

The second section, called Health Info, implies its name. It provides a wealth of information about the site and server installation and is intended for debugging or for sharing server details in support services with an IT specialist.

Information about installing WordPress, the underlying server, themes and the use of file storage is provided.

site-health

Image: Marius L. J.

SERVEHAPPY FEATURE

Another new safety feature with WordPress 5.2 is the Servehappy Project that was originally planned for release with WordPress 5.1 but was split into two, with one part of the project being delivered with WordPress 5.1 and the other part being delivered with WordPress 5.2 today.

WordPress 5.1 included the ability to warn when WordPress servers run on outdated PHP versions of servers.

WordPress 5.2, which is now available, will include’ White Screen Of Death’ (WSOD) Protection, also called’ Fatal Failure Protection,’ and works as a’ Safe Mode’ for WordPress sites.

WSOD protection works by temporarily disabling themes and plugins when a fatal PHP error occurs so that site administrators can recover access to the backends and correct the error of their sites.

wsod protection img

Image: Felix Arntz

The feature initially was scheduled for WordPress 5.1, but was postponed to version 5.2 after security researchers raised a number of scenarios where hackers had been able to abuse WSOD protection system to disable WordPress plugins and launch attacks on WordPress sites.

Future plans

But improving security for WordPress won’t stop with the release of 5.2. Additional projects include the Gossamer project, planned for WordPress 5.4.

The Gossamer project aims to port the same code signing system used for the main updates of WordPress into a framework that developers can also utilize to sign up code for WordPress themes and plugins.


Continue Reading
0
69 Views


Vulnerability
Two Game Development Companies were compromised – Backdoored in Supply-chain attacks
Moseley (Raam) Posted On March 11, 2019


After a series of successful supply-chain attacks, two popular games and a games platform developed by Asian companies have been compromised which have allowed attackers to include a malicious payload to provide a behinddoor.

The software used for the attacks on the supply chain is designed to check the region of the machines affected before the payload drops and, if the computer is Chinese or Russian, it will automatically stop the infection process, showing that the cyber criminals behind the attack have a very particular list of victims that they have to target.

The affected executable will start the malware payload on a affected system before other components, decrypting and memory-launching the backdoor in advance or using the game or gaming platform code.

During analysis, ESET identified five versions of wild malicious payload using similar configuration files, including the Command-and-Control (C&C) Server URL, a pre-configured wait time to latency execution, a string containing the campaign name, and above all a list of executable to be shut down if the backdoor is running on the infected system.

If the backdoor doesn’t shut down after checking for anti-malware solutions, the backdoor will generate a bot identification which it packs together with’ user name, computer name, windows version, and system language.

While three of the four commands support the backdoor— DownUrlFile, DownRunUrlFile, RunUrlBinInMem— it is actually disabled by setting the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersions\ImageFlag registry to 1.

Install will disable the fourth command called UnInstall. As the ESET researchers say: “When payloading begins, the registries are requested and execution is aborted if set. Maybe attackers try to reduce the load from their C&C servers by avoiding uninteresting victim callbacks.”

While the malware also comes with a second-stage payload that installs itself as a Windows service and is intended to auto-update itself, its exact functionality In ESET’s Marc-Etienne M. Léveillé analysis the malware used in the supply chain attacks on the developers of the game is the same, but the threat actors used different configurations for each attack.

Despite the different approach, the backdoor of the affected software products in all three cases was the same. Given the popularity of the hacked playing platform and games in Thailand, the Republic of the Philippines and Taiwan–the 3 most hit countries–the ESET researcher concluded after analysis of the telemetry data collected during the analysis is likely to number tens or even hundreds of thousands.

Languzge checks

At the end of ESET’s analysis, there is a comprehensive collection of compromise indicators (IOCs) containing compromised file samples, payload samples, second stage samples and MITRE ATT&CK Matrix.

Successful supply-chain attacks have led to hundreds of millions of damage

With supply-chain attacks increasing by around 78 percent during 2018 as reported in the 2019 Internet Security Risk Report.

Payload configuration
In January, hundreds of e-commerce sites were affected by a MageCart attack, which compromised a French online advertiser Adverline advertisement script.

While Magecart attacks were widely reported in 2018, with large companies including British Airways, TicketMaster, OXO and Newegg affected, the number of victims can compromise huge numbers of victims when the supply chain attacks are involved too.

Victims distribution

In 2018, hackers succeeded in compromising several organizations ‘ supply chain in South Korea, inserting malware into 141 Android devices with low-cost costs and infecting 400,000 users after successfully backdooring the Russian MediaGet BitTorrent customer.

Threatening actors had used the same methods a year earlier as part of the NotPetya attack, which led to hundreds of millions of US dollars of damage, the ShadowPad attack with a backdoor on multi-financial institutions ‘ server management software and infect the CCleaner tool which landed on their users ‘ computers.


Continue Reading
0
129 Views