Last week we covered the latest 0-day from NSO group, BLASTPASS. There’s more details about exactly how that works, and a bit of a worrying revelation for Android users. One of the vulnerabilities used was CVE-2023-41064, a buffer overflow in the ImageIO library. The details have not been confirmed, but the timing suggests that this is the same bug as CVE-2023-4863, a Webp 0-day flaw in Chrome that is known to be exploited in the wild.

The problem seems to be an Out Of Bounds write in the BuildHuffmanTable() function of libwebp. And to understand that, we have to understand libwebp does, and what a Huffman Table has to do with it. The first is easy. Webp is Google’s pet image format, potentially replacing JPEG, PNG, and GIF. It supports lossy and lossless compression, and the compression format for lossless images uses Huffman coding among other techniques. And hence, we have a Huffman table, a building block in the image compression and decompression.

What’s particularly fun about this compression technique is that the image includes not just Huffman compressed data, but also a table of statistical data needed for decompression. The table is rather large, so it gets Huffman compressed too. It turns out, there can be multiple layers of this compression format, which makes the vulnerability particularly challenging to reverse-engineer. The vulnerability is when the pre-allocated buffer isn’t big enough to hold one of these decompressed Huffman tables, and it turns out that the way to do that is to make maximum-size tables for the outer layers, and then malform the last one. In this configuration, it can write out of bounds before the final consistency check.

An interesting note is that as one of Google’s C libraries, this is an extensively fuzzed codebase. While fuzzing and code coverage are both great, neither is guaranteed to find vulnerabilities, particularly well hidden ones like this one. And on that note, this vulnerability is present in Android, and the fix is likely going to wait til the October security update. And who knows where else this bug is lurking.

Snowden and Cavium

Last year, Jacob Appelbaum published his Phd thesis, “Communication in a world of pervasive surveillance” (PDF). It went unnoticed for several months, until electrospaces.net pointed out a few interesting details. Appelbaum is a journalist and researcher, but the reason this has captured our attention is that he’s one of the few people with access to the Snowden archive. And the real bombshell was a footnote:

While working on documents in the Snowden archive the thesis author learned that an American fabless semiconductor CPU vendor named Cavium is listed as a successful SIGINT “enabled” CPU vendor. By chance this was the same CPU present in the thesis author’s Internet router (UniFi USG3).

Now, to be clear, this isn’t an allegation that Cavium, now part of Marvell Technology, was knowingly producing compromised equipment. As far as we know, this isn’t another Crypto AG. (Heavens no! The NSA tends to make reasonable-sounding suggestions that just happen to weaken cryptography in non-obvious ways.) Regardless, that this action was taken against an American company seems to be beyond the pale.

There’s more in the paper, like confirmation of project BULLRUN, the effort to sabatoge security in IETF protocols, or the bulk collection of high-entropy Internet traffic for eventual decryption. It was also interesting to learn that the NSA has apparently compromised the Russian SORM Lawful Interception program. Or to put it another way, the NSA can spy on Russian citizens just like Russia can.

Gitlab

And then there’s Gitlab. If you host a Gitlab instance with open user enrollment, it’s time to update. CVE-2023-5009 allows a user to run certain pipelines as other users, with all the security implications that includes. For deployments with untrusted users, this is a critical patch to grab.

Asahi

One of the neat things about porting Linux to new hardware is that you get really familiar with the quirks of that hardware. And when one of those quirks happens to be missing security controls on virtual memory addresses in the GPU, you score a really nice bounty. And if you’re a Vtuber, then you naturally make a video about it. And that’s how we’re here, talking about Asahi Lina’s video. And if the Vtuber format doesn’t terribly annoy you, it’s actually a really well done explanation of the vulnerability and how to use it to run code.

Be Like Retool

Nobody wants to have to write a post-mortem on their own compromise. But for a technology company, security incidents of some description are nearly guaranteed, eventually. So, if you have to do an incident response, do it like Retool. An employee fell to a sophisticated spear-phishing attack — including a deepfaked phone call — on August 27. The employee logged in to a fake portal, provided a Multi-Factor Authentication token to the portal, and then gave over a second MFA token over the phone. And that was enough to put an attacker device on that employee’s GSuite account. 27 customers had their accounts accessed. Oof.

Retool broke the proverbial glass, and hit the red emergency button, revoking everything and rolling back changes. Two days later, the mess was contained and Retool contacted all 27 customers that had been affected. And now, less than a month later, the story has been told with much more detail and transparency than we normally get. So don’t make the same mistakes that Retool did, but when you’re inevitably the one in the hot seat, be like Retool.

Bits and Bytes

Juniper released patches for a few medium-severity issues in some of their firewalls and switches. It turns out that those vulnerabilities can be used together in an RCE attack chain, considered a 9.8 on the CVSS meter. Patches and fixes are available, but the attack is as trivial as a cUrl one-liner, so get those units patched!

Google has pulled back the curtain just a bit, and shared the details on an exploit chain used in the wild against Android phones. One of the noteworthy features is that the three initial bugs were all n-day exploits — fixes had been published upstream that hadn’t landed in real user’s phones yet. And then there’s the fun of exploiting the Linux system underneath all that Android.

DEF CON videos are finally live! There are some fun talks, like hacking smart grocery carts, the Github Actions worm, and more. Enjoy!