Hey all,

Here are this week’s cyber updates.

(1) Windows 8 & 10 are vulnerable to a server-side memory corruption vulnerability(CVE-2017-0016) in the SMB service. The vulnerability allows attackers to conduct a denial of service attack (BSOD) and possibly even execute code on the remote machine.

Currently, Microsoft has yet to issue a fix for this vulnerability, and an exploit for this vulnerability is reported to be seen in the wild.

Please  restrict SMB traffic in the FW until a patch is issued by Microsoft.

Here are all the details:

And here’s the exploit code: https://github.com/lgandx/PoC/tree/master/SMBv3%20Tree%20Connect

(2) Guests of the Romantik Seehotel Jaegerwirt hotel could not enter their rooms as their keycard was not working, and some guests’ reservations were gone from the system. Apparently, the computers running the electronic key lock were infected with a ransomware.

If you ask me, this just shows you the difference between a generic attack and a target-driven approach. The attackers could have easily collected all guests’ credit card details for years, allowing them to earn much more than the paid ransom (1,500 EUR).

In this case, the hotel had to pay the ransom ASAP, as any other alternative would have ended up in very unhappy guests. But, I guess they are already used to it, as the very same hotel was hacked three times before this incident.

Now you think that the hotel would want to protect its systems and prevent such an incident from reoccurring. Well, the hotel management found a rather “creative” solution – they are considering switching back to actual door keys and locks instead of key cards and electronic locks.

Here are all the details:

(3) WordPress just patched their environment against 0-day vulnerabilities. One of their bugs existed in their REST API, allowing remote privilege escalation as well as content injection. Basically speaking, the exploit has allowed any unauthenticated user to modify all pages.

In particular, by calling to /wp-json/wp/v2/posts/123?id=456ABC, WordPress attempts to check if the user has permissions to edit post id 456ABC, and if they don’t’ the function exits. Since such a post doesn’t’ exist (post ids should be numeric), the code then calls to update_item, which should have failed again. However, update_item casts the parameter to an int, causing the value to be changed to 456. Now a malicious unauthenticated user can update item 456 (which is a valid and existing post).

Here are all the details:

(4) Netgear routers have been found to contain 31 different vulnerabilities, including unauthenticated password disclosure. While by default the admin interface is not publicly accessible, this vulnerability can be used by internal attackers to infect routers, and possibly allow a malicious entity to own a big botnet for DDoS attacks. Alternatively, the attacker can conduct MiTM attacks. Think about it the next time you connect to a Starbucks Wi-Fi network.

Here are the details:

Stay tuned for more updates,