Steve Ballmer famously called Linux “viral”, with some not-entirely coherent complaints about the OS. In a hilarious instance of life imitating art, Windows machines are now getting attacked through malicious Linux VM images distributed through phishing emails.

This approach seems to be intended to fool any anti-malware software that may be running. The VM includes the chisel tool, described as “a fast TCP/UDP tunnel, transported over HTTP, secured via SSH”. Now that’s an interesting protocol stack. It’s an obvious advantage for an attacker to have a Linux VM right on a target network. As this sort of virtualization does require hardware virtualization, it might be worth disabling the virtualization extensions in BIOS if they aren’t needed on a particular machine.

AI Finds Real CVE

We’ve talked about some rather unfortunate use of AI, where aspiring security researchers asked an LLM to find vulnerabilities in a project like curl, and then completely wasted a maintainer’s time on those bogus reports. We happened to interview Daniel Stenberg on FLOSS Weekly this week, and after he recounted this story, we mused that there might be a real opportunity to use LLMs to find vulnerabilities, when used as a way to direct fuzzing, and when combined with a good test suite.

And now, we have Google Project Zero bringing news of their Big Sleep LLM project finding a real-world vulnerability in SQLite. This tool was previously called Project Naptime, and while it’s not strictly a fuzzer, it does share some similarities. The main one being that both tools take their educated guesses and run that data through the real program code, to positively verify that there is a problem. With this proof of concept demonstrated, it’s sure to be replicated. It seems inevitable that someone will next try to get an LLM to not only find the vulnerability, but also find an appropriate fix.

Slipping Between Parsers

Something else interesting from our conversation with Daniel was the trurl tool, that makes the curl url parser available as a standalone tool. The point being that there are often security problems that arise from handling URLs and other user-provided data with different parsers. And that’s the story [Andrea Menin] has to tell, taking a look at how file parsers handle file uploads a bit differently.

More specifically, Web Application Firewalls (WAFs) check a handful of metrics on file uploads, like the file extension, MIME Type, the “magic” first few bytes of the file, file size, filename sanitization, and more. This gets complicated when an application uses multipart/form-data. Files and parameters get chunked, separated by boundary delimiter strings.

So one trick is to hide strings that the WAF would normally block, by sneaking them inside a multipart upload. Another trick is to use the same name field multiple times. The WAF may ignore the repeated names, and the application itself may not ignore the repetition in the same way. There are many more, from inconsistent quotes, to omitting an expected carriage return in the upload, to failing to mention that your filename contains UTF characters.

Backscatter TOR DoS

[delroth] got a nasty surprise. He got an abuse@ email, letting him know that one of his server VMs was sending SSH probes around the Internet. Unless you’re SSH scanning on purpose, that’s not a good surprise. That’s bad for two reasons. First off, it really implies that your server has been compromised. And second, it’s going to put your IP on multiple spam and abuse blacklists.

The natural response was to start looking for malware. The likely culprits were a Syncthing relay, a Mastodon instance, a Tor relay, and a Matrix server. The odd thing was that none of those services showed signs of compromise. The breakthrough came when [delroth] started looking close at port 22 traffic captured by a running tcpdump. No outgoing packets were getting captured, but TCP reset packets were coming in.

And really, that’s the whole trick: Send bogus SSH packets from a spoofed IP address, to a bunch of servers around the Internet, and some of them will generate complaints. Anyone can generate raw packets with spoofed IP addresses. The catch is that not everyone can successfully send that traffic, since many ISPs do BCP38 scrubbing, where “impossible” traffic gets dropped. This traffic was impossible, since those source IPs were coming from the wrong network.

The only real question is “why?” The answer seems to be TOR. While [delroth] does run a TOR node, it’s not an exit node, which is usually enough to keep the IP out of trouble. While TOR does make some guarantees about traffic anonymity, it doesn’t make any guarantees about hiding the IPs of network nodes. And it seems that it’s recently become someone’s hobby to trigger exactly these attacks on TOR nodes.

Bits and Bytes

A pair of developers have started working on hardening for the PHP language and server components. That means adding back safe-unlink, doing memory isolation to make heap spraying harder, and removing trivial ways to trivially get powerful primitives. PHP may not be the cool kid on the block any more, but it’s still very widely used, and making exploitation just a bit harder is a clear win.

Cisco’s Unified Industrial Wireless Software had a trivial command injection attack allowing for arbitrary command execution as root. This was limited to devices running with Ultra-Reliable Wireless Backhaul mode turned on. So far this flaw hasn’t been found in real attacks, but such a flaw in industrial equipment isn’t great.

And finally, Electronic Arts had an improperly secured web API endpoint, and [Sean Kahler] found it and started looking around. It turns out that API included a swagger json, which documents the entire API. Score! In the end, the API allowed for moving a “persona” from one account to another, and that eventually allows for full account takeover. Yikes.