Week of September 12, 2022: Uber breached via an MFA prompt, and OMB demands secure-software attestations

What mattered to security leaders in the week of September 12, 2022? On Thursday, September 15, an attacker got into Uber through a contractor account after repeated MFA approval requests, then reached internal tools including G-Suite and Slack. The White House Office of Management and Budget also told federal agencies, in a memo reported on September 15, to obtain secure-development attestations from their software suppliers, and eight agencies from four countries warned about ransom operations by IRGC-affiliated actors.

Uber breached through a contractor account and a flood of MFA prompts

Uber said an attacker compromised an external contractor's account on September 15, most likely using a corporate password bought on the dark web after malware infected the contractor's personal device. Repeated login attempts generated two-factor approval requests until one was accepted. The attacker then reached other employee accounts, gaining elevated access to tools including G-Suite and Slack, posted in a company-wide Slack channel and altered internal OpenDNS settings. Uber said it had seen no access to production systems, user accounts or its databases of sensitive user information, and had notified law enforcement. The episode showed how repeated push prompts can wear down MFA. (Uber, Help Net Security)

OMB requires secure-development attestations from federal software suppliers

An Office of Management and Budget memo, covered by Help Net Security on September 15, required agencies to use only software built under NIST secure development and supply chain practices, defining software broadly to include firmware, operating systems, applications and cloud services. Agencies must obtain a self-attestation from each producer before use, inventory their software within 90 days, collect attestations for critical software within 270 days and for all covered software within 365 days. Producers that cannot attest to a practice must document mitigations and a plan of action. Vendors selling to Washington now had a compliance deadline tied to how they build code. (Help Net Security)

Eight agencies warn of IRGC-affiliated actors running ransom operations

A September 14 joint advisory, AA22-257A, from the FBI, CISA, NSA, US Cyber Command, the Treasury, Australia's ACSC, Canada's CCCS and the UK's NCSC described continued activity by actors the agencies assess are affiliated with Iran's Islamic Revolutionary Guard Corps. Since early 2021 the actors had scanned for or exploited known Fortinet FortiOS flaws and Microsoft Exchange ProxyShell bugs, including CVE-2021-34473, to gain initial access, then used it for data extortion and disk encryption for ransom. The first recommended actions were patching known exploited vulnerabilities, MFA and offline backups. (CISA)

LastPass: the August intruder had four days inside its development environment

LastPass updated its notice on the August breach, saying the attacker had internal access for four days before being detected and evicted. The investigation, run with Mandiant, found no evidence that customer data or encrypted password vaults were accessed and no sign of attempts to inject malicious code. The attacker reached the development environment by impersonating a developer whose endpoint had been compromised, after that developer had completed multi-factor authentication. LastPass said development is physically separated from production and only its build release team can push code between them. (BleepingComputer)

Microsoft and Apple each patch an exploited kernel-level zero-day

Microsoft's September 13 Patch Tuesday fixed 64 vulnerabilities, including CVE-2022-37969, an exploited elevation-of-privilege flaw in the Windows Common Log File System driver; it was reported by researchers at four companies, which ZDI said suggested attacks were not narrowly targeted. In updates reported on September 13, Apple fixed CVE-2022-32917, a kernel bug that may let a malicious app run code with kernel privileges and that Apple said may have been actively exploited, in macOS 12.6 and 11.7, iOS 16 and iOS and iPadOS 15.7. It was Apple's eighth zero-day fix of 2022. (Help Net Security, Help Net Security)

Lorenz ransomware uses Mitel VoIP appliances as its front door

Arctic Wolf Labs reported on September 12 that the Lorenz ransomware gang was breaking into enterprises through CVE-2022-29499, a remote code execution flaw in the Mitel Service Appliance component of MiVoice Connect. Starting from a Mitel appliance on the network perimeter, the attackers opened a reverse shell and then used the Chisel tunnelling tool to move into the environment. Kevin Beaumont counted over 19,000 Mitel devices exposed to the internet. Phone systems belong in the same patch and exposure reviews as VPNs and firewalls. (BleepingComputer)