Last May, Ars reported that a critical vulnerability in a widely used image-processing application left a huge number of websites open to attacks that allowed hackers to execute malicious code on the underlying servers. More than five months later, Facebook paid a $40,000 bounty after discovering it was among those at risk. On Tuesday, researcher Andrey Leonov, said he was able to exploit the vulnerability in the ImageMagick application by using a tunneling technique based on the domain name system that bypassed Facebook firewalls. The firewalls had successfully protected against his earlier exploit attempts. Large numbers of websites use ImageMagick to quickly resize images uploaded by users. “I am glad to be the one of those who broke the Facebook,” Leonov wrote in a blog post that gave a blow-by-blow account of how he exploited the ImageMagick vulnerability. Two days after the researcher privately shared the exploit with Facebook security personnel, they patched their systems. Ten days after that, they paid Leonov $40,000, one of the biggest bounties Facebook has ever paid. Read 4 remaining paragraphs | Comments
Originally posted here:
That critical “ImageTragick” bug Ars warned you about? It cost Facebook $40k
wiredmikey writes: Security researchers have a uncovered a Mac OS based espionage malware they have named “Quimitchin.” The malware is what they consider to be “the first Mac malware of 2017, ” which appears to be a classic espionage tool. While it has some old code and appears to have existed undetected for some time, it works. It was discovered when an IT admin noticed unusual traffic coming from a particular Mac, and has been seen infecting Macs at biomedical facilities. From SecurityWeek.com: “Quimitchin comprises just two files: a .plist file that simply keeps the .client running at all times, and the .client file containing the payload. The latter is a ‘minified and obfuscated’ perl script that is more novel in design. It combines three components, Thomas Reed, director of Mac offerings at Malwarebytes and author of the blog post told SecurityWeek: ‘a Mac binary, another perl script and a Java class tacked on at the end in the __DATA__ section of the main perl script. The script extracts these, writes them to /tmp/ and executes them.’ Its primary purpose seems to be screen captures and webcam access, making it a classic espionage tool. Somewhat surprisingly the code uses antique system calls. ‘These are some truly ancient functions, as far as the tech world is concerned, dating back to pre-OS X days, ‘ he wrote in the blog post. ‘In addition, the binary also includes the open source libjpeg code, which was last updated in 1998.’ The script also contains Linux shell commands. Running the malware on a Linux machine, Malwarebytes ‘found that — with the exception of the Mach-O binary — everything ran just fine.’ It is possible that there is a specific Linux variant of the malware in existence — but the researchers have not been able to find one. It did find two Windows executable files, courtesy of VirusTotal, that communicated with the same CC server. One of them even used the same libjpeg library, which hasn’t been updated since 1998, as that used by Quimitchin.” Read more of this story at Slashdot.