Week of April 10, 2023: Allies publish secure-by-design principles, Microsoft fixes an exploited CLFS flaw

What mattered to security leaders in the week of April 10, 2023? CISA, the FBI, the NSA and six international partners told software makers to ship products that are secure by design and by default, and CISA issued version 2 of its Zero Trust Maturity Model. On the threat side, Microsoft's April Patch Tuesday closed a Windows logging flaw already used in ransomware attacks, Apple fixed two chained zero-days, and 3CX shared early Mandiant findings on its supply chain compromise.

Allied agencies publish secure-by-design and secure-by-default principles

On April 13 CISA, the FBI and the NSA, joined by cyber authorities from Australia, Canada, the United Kingdom, Germany, the Netherlands and New Zealand, released joint guidance titled "Shifting the Balance of Cybersecurity Risk." It asks manufacturers to take ownership of security outcomes rather than leave the burden with customers, to make secure configuration the default baseline, and to keep advisories and CVE records complete and accurate. The document gives CISOs a reference point for what to demand from suppliers during procurement. (CISA)

CISA releases Zero Trust Maturity Model version 2

Two days earlier, on April 11, CISA published the second version of its Zero Trust Maturity Model, folding in comments gathered during a 2021 public review. The update adds a new stage called Initial, giving four maturity levels in all (Traditional, Initial, Advanced and Optimal), and adds or revises functions under each. The model targets federal agencies, but CISA said every organization should review it, which makes it a usable yardstick for private-sector zero trust roadmaps. (CISA)

Microsoft patches a CLFS zero-day tied to Nokoyawa ransomware

Microsoft's April 11 Patch Tuesday fixed 97 CVE-numbered vulnerabilities. One of them, CVE-2023-28252 in the Windows Common Log File System, was already exploited and lets an attacker gain SYSTEM privileges. An update to Help Net Security's report on April 12 said a cybercrime group was using it in attempts to deliver Nokoyawa ransomware. It was the second CLFS privilege-escalation zero-day of 2023, so endpoint teams had reason to push this patch ahead of routine cycles. (Help Net Security)

Apple fixes two chained zero-days in iPhones and Macs

Apple shipped updates for macOS, iOS and iPadOS closing CVE-2023-28205, a WebKit use-after-free reachable through malicious web content, and CVE-2023-28206, an out-of-bounds write in IOSurfaceAccelerator that grants kernel privileges. Researchers from Google's Threat Analysis Group and Amnesty International's Security Lab reported the pair, which had been used together for full device compromise; spyware installation was the likely but unconfirmed goal. (Help Net Security)

3CX publishes interim Mandiant findings on its supply chain compromise

3CX released an interim report on Mandiant's investigation into the March compromise that turned its desktop software into a supply chain attack on cryptocurrency companies. The findings named TAXHAUL malware and the COLDCAT downloader on Windows and a macOS backdoor called SIMPLESEA, with persistence achieved through DLL side-loading. Mandiant continued to attribute the activity to a threat actor with a North Korean nexus. The company also announced a security update to its browser-based progressive web app. (Help Net Security)

Yum! Brands notifies individuals of data stolen in January ransomware attack

Yum! Brands, owner of KFC, Pizza Hut and Taco Bell, began mailing breach notification letters to an undisclosed number of people whose data was taken in a January 13 ransomware attack. The company had earlier said it had no evidence that customer information was exfiltrated; the letters listed names and driver's license or other ID card numbers among the exposed data. Its annual report said the attack closed fewer than 300 restaurants in one market for one day. (BleepingComputer)

Darktrace finds no evidence behind a LockBit breach claim

After the LockBit ransomware gang listed Darktrace on its leak site, the security vendor reviewed its internal systems and said it found no sign of compromise. On Friday, April 14, CISO Mike Beck confirmed that neither Darktrace's nor its affiliates' systems had been compromised and that customer service was running normally. BleepingComputer reported that the gang appeared to have confused Darktrace with the threat intelligence firm DarkTracer. The episode shows why a leak-site listing alone does not establish that a breach happened. (BleepingComputer)