RSA ROCA Attack CVE-2017-15361

Wapack Labs observed a new variant of the Coppersmith attack against RSA encryption, which impacts a number of vulnerable Google Chromebooks and Windows devices by Fujitsu, HP, Lenovo, and Microsoft. The attack, called the Return of Coppersmith’s Attack (ROCA) against RSA encryption, allows an attacker to decrypt cryptographic smartcards, security tokens and other secure hardware chips, like the Trusted Platform Modules (TPMs) used by BitLocker and Windows 10 Secure Boot, with less computational effort than previously thought. The ROCA attack allows an attacker to calculate the private key, while only having access to the public key, while using less computational resources than previous attacks. Updates are already being posted by device manufacturers. Wapack Labs recommends that users of Google Chromebooks, Google, Fujitsu, HP, Lenovo, and Microsoft devices upgrade their RSA cryptographic libraries (likely a firmware update) as soon as the patches are issued...READ MORE

Wapack Labs has cataloged and reported on cryptographic attacks and vulnerabilities in the past. An archive of related reporting can be found in the Red Sky Alliance portal. 

WWW.WAPACKLABS.COM

CVE-2017-12615

Wapack labs observed a recent Common Vulnerabilities and Exploit (CVE), CVE-2017-12615, being discussed in a Romanian hacker forum. A moderator on the forum posted an explanation of the exploit, a link to the National Vulnerability Database, and a GitHub link documenting how to weaponize the exploit in the Metasploit-framework. CVE-2017-12615 is assessed with a high severity rating (8.1/10) as it allows an attacker unauthorized modification to Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled. HTTP PUT places a file or resource at a specific URI, and exactly at that URI. If there is already a file or resource at that URI, PUT replaces that file or resource. If there is no file or resource there, PUT will create one. PUT is idempotent, but, paradoxically, PUT responses are not cacheable. Successful exploitation enables an attacker to upload a JSP file, request the file and execute its contents to gain remote access to the system. Wapack Labs is providing this report to Red Sky Alliance members for situation awareness. With the CVE and methods being posted in the wild, hackers may be more likely to attempt this attack. Wapack Labs recommends all Red Sky Members who use Apache Tomcat apply a security update and ask their Red Team members to test network assets to ensure the patch updated correctly...READ MORE

Wapack Labs has cataloged and reported CVEs in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Uptick in the Wild: CVE2017-0911

As early as January 2017, cyber threat actors began using a then zero-day MS Office remote code execution exploit for CVE-2017-0199 in targeted attacks. Large scale Dridex campaigns occurred shortly following the vulnerability disclosure in April. Like many other Office vulnerabilities, CVE-2017-0199 has been exploited by multiple actors including cyber criminals and nation-state actors alike. Recent activity indicates the continued exploitation of this vulnerability...READ MORE

Wapack Labs has cataloged and reported extensively on zero-day exploits in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM