For a smart home company with an emphasis on cloud-connected cameras, what could possibly be worse than accidentally showing active cameras to the wrong users? Doing it again, to far more users, less than 6 months after the previous incident.

The setup for this breach was an AWS problem, that caused a Wyze system outage last Friday morning. As the system was restored, the load spiked and a caching library took the brunt of the unintentional DDoS. This library apparently has a fail state of serving images and videos to the wrong users. An official report from Wyze mentions that this library had been recently added, and that the number of thumbnails shown to unauthorized users was around 13,000. Eek. There’s a reason we recommend picking one of the Open Source NVR systems here at Hackaday.

ScreenConnect Exploit in the Wild

A pair of vulnerabilities in ConnectWise ScreenConnect were announced this week, Proof of Concepts were released, and are already being used in active exploitation. The vulnerabilities are a CVSS 10.0 authentication bypass and a CVSS 8.4 path traversal bypass.

Huntress has a guide out, detailing how embarrassingly easy the vulnerabilities are to exploit. The authentication bypass is a result of a .Net quirk, that adding an additional directory on the end of a .aspx URL doesn’t actually change the destination, but is captured as PathInfo. This allows a bypass of the protections against re-running the initial setup wizard: hostname/SetupWizard.aspx/literallyanything

The second vulnerability triggers during extension unpack, as the unzipping process doesn’t prevent path traversal. The most interesting part is that the unzip happens before the extension installation finishes. So an attacker can compromise the box, cancel the install, and leave very little trace of exploitation.

Chinese Spyware

A rather interesting story broke this week, where someone leaked documents to GitHub, detailing the capabilities of a Chinese spyware vendor. Unfortunately the repository has been closed, but efforts on X to analyze and archive the information is enough to take a look at.

#threatintel
someone just leaked a bunch of internal Chinese government documents on GitHubhttps://t.co/BO8N64A7kF

— 安坂星海 Azaka 🐼 VTuber (@AzakaSekai_) February 18, 2024

Some of the capabilities are interesting and yet straightforward, like capturing Twitter information, reading DMs, and posting on the victim’s account. The vendor boasts of a custom Remote Access Trojan for Windows, with all the normal features, from a remote shell to keylogging and fill access.

Things take a turn for the weird when we get to iOS support. The claim is that all versions are supported, and without any jailbreak it has access to GPS, files, contacts, and real-time audio.

Linux is supported, but CentOS 5-7 and Ubuntu 12 and 14. That’s some oddly specific, and oddly old distros. Some of the other documents seem to indicate this is a dump of some old data, with out-of-date interfaces shown in screenshots. Digging into the rest of the documents seems to indicate this data dump is from a small red-team that sold their services to regional Chinese government bodies. It’s unclear why the records were dumped online now, but it’s a fascinating look into how that particular part of the world works.

Don’t Trust North-Korean Job Postings

North Korean attackers have been known to reach out to vulnerability researchers under the guise of sharing research, only to send them “research” that’s actually malware, in an attempt to get access to zero-days. In a similar campaign, it seems these same actors are looking for software developers, and making fraudulent job offers. The hook here seems to be a coding test, that requires the use of a specific malicious repository.

The discovered malware seems to be the same or similar campaign to one discovered by Unit42 in late 2023. Most interesting is that the Phylum researchers have tracked activity in this campaign as late as February 21 of 2024. Malicious actors are moving repositories around, attempting to keep the campaign alive.

Bits and Bytes

The Yealink Configuration Encrypt Tool used a single global AES key to generate encrypted phone configurations. This means that all those “encrypted” configs are easy pickings for decryption. It also means trivial replacement of settings. Not great. Version 1.2 fixes the issue, but all those old config files are forever effectively in the clear.

Joomla has fixed a quartet of medium severity issues that could make for a nasty surprise for a Joomla admin. The most serious is a Cross-Site scripting flaw that allowed unsanitized addresses. There are technical details missing, including whether that’s e-mail or physical addresses. Either way, 4.4.3 and 5.0.3 are out with the fixes, so roll it out!

And finally, in the why-we-can’t-have-nice-things file, SSH Snake is now being used by threat actors in real attacks. We covered this nifty tool earlier this year, as a great way to audit how systems are tied together with ssh keys. And of course, Sysdig researchers have found it being used in the wild. I do regret their choice to call it a worm. And it’s probably doomed to be one of those tools that is perfectly legitimate, and yet is forever cursed to be flagged and blocked by security systems.