ACSC Business Partner Newsletter – Cyber Warnings and Advice-May 2023

Passphrases

 

Multi-factor authentication (MFA) is one of the most effective ways to protect your accounts from cybercriminals. You should also consider using a strong password or passphrase to protect your account.

 

What is a passphrase?

 

A passphrase uses four or more random words as your password. For example, ‘crystal onion clay pretzel’ or ‘red house sky train’. The longer the passphrase, the harder it is for adversaries to crack.

A unique, strong passphrase can better protect your account compared to a simple password.

 

To create a strong passphrase you should consider making it:

– Long

– Unpredictable

– Unique

 

If a website or service requires a complex password including symbols, capital letters, or numbers, then you can include these in your passphrase.

 

Use a password manager to create and manage passwords

 

If you have multiple accounts with different passwords or passphrases, a password manager can help control them for you. A password manager is an application or program that stores passwords or passphrases for all of your accounts. With a password manager, you only need to remember one master password.

 

You can also use a password manager to create secure, long, and randomly generated passwords. The longer and more random, the better. Make sure to generate a different password for every account.

 

Our practical publications

 

Take a look at our guides through the link below for more detailed advice on how you can create secure passphrases and use a password manager, to further protect your online accounts and personal information.

 

Supply Chain Compromise of 3CX DesktopApp

 Open source reports have emerged describing a supply chain compromise affecting multiple versions of 3CX DesktopApp for Windows and Mac.

 

3CX DesktopApp is a voice and video conferencing app. Reports suggest malicious actors have been able to modify the legitimate 3CX DesktopApp installer to trojanise the software, potentially enabling further malicious activity, such as installation of malware, against users of affected software versions.

 

The ACSC is aware of reports suggesting there is an active state-sponsored intrusion campaign targeting 3CX DesktopApp users. The ACSC has not received any reports of Australian organisations targeted in this campaign.

 

Reports relating to this campaign, and accompanying indicators of compromise (IOCs) are available from:

CrowdStrike

SentinelOne

 

3CX advises customers who use the affected desktop client to uninstall the software and use the browser-based Web App (PWA) until 3CX can deliver a new, secure version.

 

The ACSC recommends users of 3CX DesktopApp review the Security Alert published by 3CX and continue to review and follow the vendor’s advice.

Widespread Exposure of Vulnerability in cPanel

 

 

The ACSC is aware of a critical vulnerability (CVE-2023-29489) affecting many versions of cPanel and cPanel managed websites.

 

cPanel is a very popular website and server management software. It is used extensively in Australia businesses, and amongst Australian Government.

 

Exploitation of the vulnerability could allow a malicious actor to perform remote code execution against any user who are served, and click, a malicious link from one of these vulnerable systems.

 

Despite this vulnerabilities severity being rated ‘medium’, due to the very widespread use of the service CHIPs believes that the impact of this vulnerability is quite high.

 

The ACSC is not aware of any public exploitation of this vulnerability. There are however public Proof of Concepts (POCs) and technical write-ups which increases the risk of this vulnerability being used in the future.

 

Affected Australian organisations should apply the available patch immediately and investigate for signs of compromise.

 

Australian organisations that use cPanel should also read cPanel disclosure TSR-2023-0001 and take the recommended actions.

Important Vulnerabilities in Microsoft’s May 2023 Security Update

 

The ACSC has reviewed the Microsoft May 2023 Security Update.

 

The Security Update provided patches for 40 vulnerabilities:

 

2 vulnerabilities are believed to have been exploited

 

6 vulnerabilities are rated ‘Critical’

 

The following vulnerabilities are important based on their severity, widespread use of the related product and/or likelihood of exploitation.

 

Network File System (NFS) Remote Code Execution (CVE-2023-24941)

 

Outlook Remote Code Execution (CVE-2023-29325)

 

Lightweight Directory Access Protocol Remote Code Execution (CVE-2023-28283)

 

Multiple SharePoint vulnerabilities (CVE-2023-24955, CVE-2023-24950, CVE-2023-24954)

 

Win32 Kernel Elevation of Privilege (CVE-2023-29336)

 

Windows Secure Boot Bypass Flaw (CVE-2023-24932)

 

Technical subject matter experts that use Microsoft products should read the associated security update guides available for their products through the below link.

 Cyber News

Domestic Cyber News

 

Hunting Russian Intelligence “Snake” Malware – Joint Cybersecurity Advisory | ACSC

The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s Federal Security Service (FSB) for long-term intelligence collection on sensitive targets.

 

We have identified Snake infrastructure in over 50 countries, including Australia. Within the United States, the FSB has victimized industries including education, small businesses, and media organizations, as well as critical infrastructure sectors including government facilities, financial services, critical manufacturing, and communications.

 

This advisory provides background on Snake’s attribution to the FSB and detailed technical descriptions of the implant’s host architecture and network communications. The advisory also addresses a recent Snake variant that has not yet been widely disclosed. The technical information and mitigation recommendations in the advisory are provided to assist network defenders in detecting Snake and associated activity. For more information on FSB and Russian state-sponsored cyber activity, please see the joint advisory Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure and CISA’s Russia Cyber Threat Overview and Advisories webpage.

International Cyber News

 

People’s Republic of China (PRC) State-Sponsored Cyber Actor Living Off the Land to Evade Detection | ACSC

 

This advisory highlights a recently-discovered cluster of activity affecting networks across US critical infrastructure sectors, and provides threat hunting advice and best practices for network defenders to detect related activity.

 

The advisory details the tactics, techniques and procedures (TTPs) employed by the threat actor, which primarily involve the use of built-in Windows tools on compromised hosts to achieve their objectives. This is known as “living off the land”, and allows the actor to evade detection by blending in with normal Windows system and network activity, and avoid triggering security alerts by installing new tools.

The authoring agencies assess there is significant risk these TTPs could be employed by the actor against critical infrastructure (CI) and other sectors worldwide.

Given the potential threat to CI sectors outside the US, the ACSC strongly encourages Australian organisations to review the advisory, reported TTPs and indicators of compromise (IOCs) and investigate their networks for signs of potential malicious activity. By design, “living off the land” is intended to resemble legitimate system and network activity, so any findings should not be assumed malicious without further investigation.

Small Business Resources

The Australian Cyber Security Centre (ACSC) provides trusted and relevant information on how Australia’s small and medium businesses can protect themselves from the most common cyber security threats.

Get social

Be sure to follow us on Twitter and Facebook and subscribe to our YouTube channel for the latest campaign content and practical advice to help Australians improve their cyber security.

Are you a victim of cybercrime? Visit ReportCyber to take your next steps.

 

We use hyperlinks to give you more information. If you don’t want to click hyperlinks, you can search for the information on cyber.gov.au.

 

CONTACT US
Facebook: https://www.facebook.com/cybergovau
Twitter: https://twitter.com/CyberGovAU
Web: www.cyber.gov.au

If you no longer wish to receive this information, you can unsubscribe