Friday 22nd November 2024

Good morning everyone, a very happy Friday and thank you for joining me for the latest instalment of Cyber Daily.

In today’s edition:

• Google’s AI fuzzing tool just found bugs in OpenSSL that have been hiding for 20 years.
• Facebook Ads Manager accounts are under siege from a Python-based malware, NodeStealer.
• Citrix Session Recording vulnerabilities are being probed in the wild, despite their “medium severity.”

Enjoy the read and have a great end to the week!

NodeStealer 2.0: Targeting Facebook Ad Accounts and Browser Data

A revamped version of the Python-based NodeStealer malware is making waves, with threat hunters warning it's now capable of raiding Facebook Ads Manager accounts and siphoning credit card data from web browsers.

The malware, linked to Vietnamese threat actors, harvests cookies to log into Ads Manager and use the Facebook Graph API to extract account details and budgets, potentially weaponising accounts for malicious ad campaigns. To evade scrutiny, NodeStealer avoids infecting machines in Vietnam and employs crafty techniques like unlocking SQLite database files via Windows Restart Manager.

Cybercriminals further exfiltrate data using Telegram, underscoring its persistence as a tool for cyberattacks. In parallel, phishing tactics like the ClickFix technique exploit fake CAPTCHA verifications, tricking victims into executing malicious scripts.

These evolving threats underline the pressing need for businesses to secure ad accounts and reinforce employee awareness around phishing techniques. With attackers leveraging trusted platforms like Facebook, vigilance remains key.

Citrix Vulnerabilities Under Attack: Act Fast

Two freshly patched vulnerabilities in Citrix's Session Recording component (CVE-2024-8068 and CVE-2024-8069) are drawing exploitation attempts mere hours after a proof-of-concept (PoC) was made public by researchers.

Discovered by WatchTowr, these flaws enable privilege escalation and remote code execution, potentially allowing attackers to target Citrix Virtual Apps and Desktops setups. Though Citrix deems the issues “medium severity,” researchers argue they’re a bigger deal: many organisations expose Session Recording servers to the internet, contrary to Citrix’s recommendations.

What's happening?

• Exploitation attempts have been observed globally, with attackers leveraging MSMQ technology to exploit unpatched servers.
• Reports suggest some attempts are from researchers, but malicious actors are likely probing for weaknesses too.

Citrix urges users to update immediately. The advisory emphasises isolating Session Recording servers on trusted networks and enabling HTTPS with Active Directory for authentication.

Citrix flaws are no strangers to exploitation, with two of its vulnerabilities ranking among the most exploited in 2023. Businesses relying on Citrix need to patch now to stay ahead.

AI-Powered Fuzzing Finds Decades-Old Bugs

Google’s AI-enhanced fuzzing tool, OSS-Fuzz, has helped identify 26 vulnerabilities across open-source projects, including CVE-2024-9143, a medium-severity flaw in the OpenSSL cryptographic library. The bug, which had lingered in the codebase for nearly two decades, could enable remote code execution or application crashes.

AI has proven instrumental in uncovering these issues by generating fuzz targets that surpass human-written ones in code coverage. Since integrating large language models (LLMs) into OSS-Fuzz in 2023, the tool has added over 370,000 lines of fuzzing code to 272 C/C++ projects, unearthing hard-to-find bugs in deeply nested code paths.

Why it matters:

• Google is transitioning its own projects to memory-safe languages like Rust and bolstering C++ safety with Safe Buffers and hardened libc++.
• These efforts aim to mitigate risks tied to spatial memory vulnerabilities, which remain a major security challenge.

With AI taking the lead in finding vulnerabilities, automated security tools are transforming how developers secure open-source software.