This week, we explore lessons learned from the recent Snowflake data breach and vulnerabilities around Microsoft MSMQ, PHP remote code execution, and an actively exploited CVE by Black Basta.
These data breaches have involved organizations including Ticketmaster, Santander Bank, QuoteWizard, LendingTree, Advanced Auto Parts, Cylance, and more.
In a recent report, Mandiant has attributed this cluster of activity to a group they call UNC5537. Mandiant stated in the report that there is no evidence of unauthorized access to Snowflake customer accounts due to a breach in the Snowflake environment. Instead, in each incident they investigated, they were able to trace the unauthorized access back to credentials discovered in infostealer malware logs. Using these stolen valid credentials from the infostealer malware, the threat actor was able to gain direct access to the victim's Snowflake instance and exfiltrate large quantities of data.
One of the most important details in Mandiant's findings was that none of the accounts abused in these attacks had multi-factor authentication (MFA) enabled.
Additionally, it was noted that some of the observed credentials were still valid several years after they were stolen, indicating they had not been rotated or updated.
Finally, it was observed that Snowflake customer instances did not have any network allow lists enabled on their accounts. Doing this would only allow connections from trusted sources (not the entire internet).
While organizations may enforce strict security policies within the boundaries of their own networks, sometimes third-party relationships can be overlooked.
Today, almost every organization stores data with 3rd party storage providers. This introduces a certain level of risk that must be managed accordingly. This management should include documenting the vendor, the services the vendor provides, the sensitivity of the data being stored, and the management of access for this provider.
Access management standards that have been applied for internal use should be replicated to these providers – this includes MFA, password rotation, and separation of duties.
The following steps are recommended for all Snowflake customers:
Additionally, there are some general best practices for securing cloud environments:
Additional Resources
The latest Patch Tuesday update from Microsoft includes a critical remote code execution vulnerability in the Microsoft Message Queueing (MSMQ) service. The vulnerability is tracked as CVE-2024-30080, and has a CVSS score of 9.8.
It can be exploited by an unauthenticated attacker sending a specially crafted malicious MSMQ packet to a vulnerable server which then allows for remote code execution on the server. The MSMQ service needs to be enabled on the system for a server to be vulnerable.
Administrators can verify if this service is enabled by checking for the Message Queuing service running on port 1801.
While there are currently no publicly available exploits for this vulnerability, administrators are urged to apply the security updates as soon as possible.
Additional Resources
A "trivially easy" to exploit remote code execution vulnerability in PHP was recently disclosed by security researchers at Devcore. The vulnerability, tracked as CVE-2024-4577, is due to errors in the way PHP converts Unicode characters into ASCII.
The flaw affects all versions of PHP when using Apache and PHP-CGI on Windows servers (which includes all versions of XAMPP). Proof-of-concept exploit code is already in the wild for this vulnerability, and CISA added it to the Known Exploited Vulnerabilities Catalog on June 13.
Administrators are urged to upgrade to the latest PHP versions as soon as possible (8.3.8, 8.2.20, and 8.1.29), or disable PHP CGI in the Apache HTTP Server configuration if it is not needed.
Additional Resources
CISA recently added a high-severity Windows privilege escalation vulnerability to its Known Exploited Vulnerability Catalog. The vulnerability is tracked as CVE-2024-26169, and is a flaw in the Microsoft Windows Error Reporting Service.
Successful exploitation of this flaw can lead to an attacker gaining SYSTEM privileges.
Research from Symantec showed evidence the Black Basta ransomware gang leveraged this vulnerability as a zero-day.
Security updates for this vulnerability were part of Microsoft's March Patch Tuesday. Administrators are urged to apply the security updates as soon as possible.
Additional Resources
Stay updated with PacketWatch's cybersecurity content by subscribing to our monthly newsletter, delivered to your inbox on the last Tuesday of the month.
PacketWatch publishes this report and other cybersecurity threat intel to the security community for free via our blog.
If you want personalized threat intel, contact us today to learn about our enterprise threat intelligence services.
Note: We've also enriched our original threat intelligence report by including resources from our partner in cyber threat intelligence, SOCRadar. You may need a registered SOCRadar account to view their threat intelligence resources.
DISCLAIMER
Kindly be advised that the information contained in this article is presented with no final evaluation and should be considered raw data. The sole purpose of this information is to provide situational awareness based on the currently available knowledge. We recommend exercising caution and conducting further research as necessary before making any decisions based on this information.