It’s time to talk about Microsoft’s patch Tuesday, and the odd vulnerability rollback that happened. CVE-2024-43491 has caught some attention, as it’s a 9.8 on the CVSS scale, is under active exploitation, and results in Remote Code Execution (RCE). Yikes, it sounds terrible!

First off, what actually happened? The official statement is that “build version numbers crossed into a range that triggered a code defect”. We don’t know the exact details, but it’s something like an unsigned integer that was interpreted as a signed integer. A build number could have rolled over 32767, and what was intended to be 32768 or higher suddenly became −32767. Lots of “if greater than or equal” logic breaks down in that situation. Because of a logic flaw like this, certain versions of Windows 10 were unintentionally opting out of some historical security fixes.

And that’s where the high CVSS score and active exploitation descriptor comes from. This is simply the highest score of the resurgent flaws, and an acknowledgement that they have been exploited in the past. The good news is that this only applies to Windows 10 build 1507, so either the original install without any of the major updates installed, or one of the Windows 10 Enterprise Long-Term Servicing Branch (LTSB) versions. It seems that the March 2024 monthly security update introduced the problem, and it wasn’t fixed until this month’s updates.

Tracking Bikes, Busting Thieves

This is a bit different from our normal fare. [Bryan Hance] started the Bike Index, an online registry for high value bikes, with the goal of tracking and recovering bikes after they are stolen. After years of success tracking down bikes, there was something new brewing. Stolen bikes from California were showing up on Facebook Marketplace, for sale down in Mexico. It was a literal international theft ring, racking up a score of over $2 million worth of bicycles.

You know that feeling that you’re probably giving away too much personal information by having a Facebook account? It turns out that’s a good way to get busted for international crime, too. In this case, an account selling the bikes south of the border had a Facebook friend close to where the crimes were being committed. And some of the bike pictures included orange shelves. That was enough to identify an auto shop that was being used to stage the stolen bikes. One criminal arrested, but the rest of the operation is still running. Similar to the challenges of going after cybercriminals that operate from overseas, it’s a challenge for law enforcement to go after bike thieves across the southern border.

Don’t Let Those Domains Expire

Researchers at Watchtowr just wanted to find a few vulnerabilities in WHOIS handling. WHOIS is part of the domain name system, and returns contact information for domains. How exactly does that lookup happen? Broadly speaking, each top level domain has a WHOIS server, and the Internet Assigned Numbers Authority (IANA) just publishes a list of server domain names for each TLD. What happens when a TLD changes their server name?

The .mobi TLD did just this, retiring whois.dotmobiregistry.net to move to a new domain. And by retire, we definitely mean abandon and completely forget about. Because the domain name registration was allowed to expire. And because they couldn’t help themselves, researchers at Watchtwr ran out and registered the domain. Surely there wouldn’t be any hosts in the wild still looking to this retired domain name for WHOIS data, right? Right? Based on the 76,085 unique IP address that hit the domain doing WHOIS lookup within the first three hours, we’re guessing that stale data is quite widespread.

The original attack was to prove that an exploit in WHOIS handling could actually be useful in the real world. But WHOIS data is actually used for some interesting cases. Like verifying SSL certificate requests. While they didn’t actually generate a forged certificate, it certainly looks like multiple certificate authorities would have gladly issued a microsoft.mobi certificate.

Sextortion Comes to your House

[Krebs] has the low-down on a new low in sextortion scams. If you haven’t seen this exact breed of scammy spam messages, it’s usually an email that claims that compromising pictures were taken using your webcam. You’re supposed to then pay Bitcoin to get the scammer to delete the non-existent images. Once you understand that it’s just spam it’s easier to ignore. Until now. These spam messages are generally generated using information from data breaches, and sometimes those include street addresses.

The new trick is to grab an image from the Internet of that address, and include it in the spam message. It’s just a bit harder to ignore a spam email when it includes a picture of your house and front yard. But ignore them you should, as well as being careful with webcams and cell phones, because while this is just a spam message, illicit image capture does happen, and that’s worse than a simple spam email. That said, you’ll probably know when it happens to you — we presume they’ll show you a copy of the goods as motivation.

Bits and Bytes

Adobe Acrobat Reader has released an update that fixes CVE-2024-41869, a use-after-free vulnerability that could lead to RCE. To make it worse, there is an proof-of-concept exploit publicly available.

Elastic Kibana has a deserialization flaw related to its integration assistant in version 8.15.0. This YAML parsing issue was fixed with version 8.15.1, and requires both Elastisearch and Kibana privileges to exploit, but it’s a CVSS 9.9, so considered very severe and likely to be exploited.

The Apache Customer Relationship Management software, OFBiz, has had a series of unauthenticated RCEs on both Linux and Windows. It’s a series because of several incomplete patches of the root issue, followed by finally fixing it. The core flaw is that the server logic and the web client can desync, leading to incomplete security checking. 18.12.16 finally lands the fix.