Yan Pollack

"With great power comes great responsibility." - Uncle Ben A few months ago, I received a call from a dedicated member of OTI - The Israeli Autism Association. They had noticed suspicious activity in their email system and had heard about OP Innovate's Digital Forensics and Incident Response (DFIR) services. Without hesitation, Omer Pinsker, Ben B., Mickey Alton, and I decided to help. In our free time, we thoroughly investigated the situation to ensure the organization's data was secure. We also conducted a penetration test to confirm that the attacker would not find another way in. It's infuriating to think someone would target a non-profit organization that supports autistic children. If I could, I would confront the attacker personally for attempting to harm such a noble cause. At OP Innovate, we always stand by those who need cyber protection the most. If you are a non-profit organization facing cybersecurity challenges, feel free to reach out to me on LinkedIn. #CyberSecurity #PenetrationTesting #DFIR #NonProfitSupport #OPInnovate

46

1 תגובה

What’s happening with Tenable in Israel? Check out our new LinkedIn and Instagram pages for the latest on events, activities, news and research. LinkedIn: https://lnkd.in/gFRd-6nR Instagram: @TenableIsrael

6

-7- Outlook Unleashing RCE Chaos: CVE-2024-30103 & CVE-2024-38021 - Michael Gorelik, Arnold Osipov Sometimes, a vendor releases a patch fixing a vulnerability you are working on. Disappointing, isn't it? In this talk, Michael Gorelik and Arnold Osipov show how they turned two patches for Outlook issues back into vulnerabilities! First, the focus is Outlook custom forms — a feature allowing creation of tailored messages in emails. Under the hood, forms are COM objects, defining a new form type means creating a config file for it, with a value copied to the registry specifying the COM server handler for it. So, what if we make the key point at some DLL that we control? That's immediately RCE! To block this, Outlook uses a denylist that filters out registry keys allowing RCE like `inprocserver32`, `localserver`, etc. A vulnerability from earlier this year found the denylist matching fails if you specify an absolute path rather than a relative path (so a `\CLSID\...\inprocserver32=` is a-okay!). This allows hijacking any COM object in the registry. Luckily, this vulnerability has been patched. But, remember the premise of the talk? The patch disallowed starting the path with a backslash. So what did Michael and Arnold do? Add a backslash at the end! This works because `RegCreateKeyExA` deletes the last backslash in the path. However, this happens *after* the denylist check, which passes and so we have a vulnerability! Second, the talk looks at Outlook Moniker objects—those are "smart links" in Outlook, allowing you to send emails embedding special links like Ca lender invites, Excel files, etc. Being simple pointers, it is possible for malicious actors to send emails with references to remote files, potentially leaking NTLM credentials if the user clicks them. Fortunately, Outlook blocks these links. *Unfortunately*, earlier this year it was found that if you add an exclamation mark (!) at the end of the link, Outlook blocking won't work. The reason is a bit complicated, but in short—the link is being treated as a special kind of Moniker, triggering a different flow composed of a few functions, which are vulnerable to remote file access. This vulnerability was patched by installing a hook on a certain vulnerable function at the end of the flow. The hook checks if a certain flag is set, and if so, blocks the call. The flag is set at the beginning of a function earlier in the flow. So only when the two functions are chained, the call is blocked. Notice the issue? If another Moniker flow eventually reaches the vulnerable function without passing through the first one, the flag isn't set and the patch won't work! Indeed, the researchers discovered such a flow—a link within an image tag instead of a hyperlink While a bit convoluted for someone who hasn't touched COM objects for at least a decade, this is still an eye-opening talk on the possibility of finding vulnerabilities in patches. youtu.be/GwwxeY11xMI #DEFCON #Vulnerability #Outlook

22

3 תגובות

Cyber Attack Market Research 🔎 Understanding Modern Threats - How Cyber 2.0 Tackles New Security Challenges An analysis of the major threats in the market and how we enhance protection levels. 📽️ https://lnkd.in/dsXjNX74 Hertzel Ozer Victor Ruiz Guy Tessler Tatyana Sarel Tatiana Yamin Iana Hefer Asaf Almog Galit Abramov Sapir Sason Guy Dahan srikanth sai Tal Meister #ThreatAnalysis #CyberResearch #Cyber2point0

13

2 תגובות