Tuesday, March 19, 2024

Apple iTunes for Windows Zero-day Exploited by BitPaymer Ransomware

Researchers found a new footprint about the recent BitPaymer ransomware campaign that was exploited the Apple iTunes for Windows Zero-day vulnerability to attacker public and private sectors across the U.S.

Threat actors took advantage of a zero-day vulnerability that resides in the Bonjour Updater that comes packaged with iTunes for Windows and abused the unquoted path vulnerability to evade the detection and maintain the persistence.

Bonjour is an updater mechanism used by Apple to deliver future updates, and it has a separate installation entry to perform a scheduled task.

The BitPaymer ransomware attack was targeting the industries such as finance, agriculture, technology, and is targeting at least 15 organizations.

The unquoted path vulnerability is one of the rarely seen flaws and is well known in the cybersecurity industry for 15 years, which often the vulnerability is used to perform a privilege escalation attack since it exists in a process with admin rights.

 “Software developers are using more and more object-oriented programming, and many times when assigning a variable with a path, they assume that using the String type of the variable alone is enough – well it’s not! The path still needs to be surrounded by quotes (“\\”).” Morphisec researchers says in Blog post.

BitPaymer Ransomware Attack Surface in Bonjour 

Windows users unaware that they need to separately uninstall the Bonjour component when uninstalling the iTunes, but if it is failed to uninstall, then the machine has still allowed the updater task where the vulnerability resides.

Morphisec researchers found that the Bonjour updater is installed on a large number of computers across different enterprises even after they uninstall iTunes from their system.

But Bonjour component remains silently in the system without updates and working in the background. This attack surface motivates attackers to choose this process for evasion.

“As many detection solutions are based on behavior monitoring, the chain of process execution (parent-child) plays a major role in alert fidelity. If a legitimate process signed by a known vendor executes a new malicious child process, an associated alert will have a lower confidence score than it would if the parent was not signed by a known vendor.”

In this case, attackers taking advantage of the presence of Bonjour to perform an attack since the Bonjour component is signed, and known which help to remain undetected.

Basically, a malicious “program” doesn’t come with .exe extension which doesn’t fall under the security software scanning since it tends to scan only specific file extensions to prevent the infection.

“Bonjour was trying to run from the “Program Files” folder, but because of the unquoted path, it instead ran the BitPaymer ransomware since it was named “Program”. This is how the zero-day was able to evade detection and bypass AV.”

Bonjour updater zero-day vulnerability mainly used to evade detection, and there is no evidence found that the BitPaymer ransomware neither writes any files on victims machine nor escalate any privileges.

 Apple patched the vulnerability in both iTunes 12.10.1 for Windows and iCloud for Windows 7.14.  users are highly recommended to update the new version to prevent a future attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Website

Latest articles

Hackers Exploiting Microsoft Office Templates to Execute Malicious Code

In a cyberattack campaign dubbed "PhantomBlu," hundreds of employees across various US-based organizations were...

How ANY.RUN Malware Sandbox Process IOCs for Threat Intelligence Lookup?

The database includes indicators of compromise (IOCs) and relationships between different artifacts observed within...

CryptoWire Ransomware Attacking Abuses Schedule Task To maintain Persistence

AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in...

E-Root Admin Sentenced to 42 Months in Prison for Selling 350,000 Credentials

Tampa, FL – In a significant crackdown on cybercrime, Sandu Boris Diaconu, a 31-year-old...

WhiteSnake Stealer Checks for Mutex & VM Function Before Execution

A new variant of the WhiteSnake Stealer, a formidable malware that has been updated...

Researchers Hacked AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles