Saturday, December 2, 2023

Apple iTunes for Windows Zero-day Exploited by BitPaymer Ransomware

Researchers found a new footprint about the recent BitPaymer ransomware campaign that was exploited the Apple iTunes for Windows Zero-day vulnerability to attacker public and private sectors across the U.S.

Threat actors took advantage of a zero-day vulnerability that resides in the Bonjour Updater that comes packaged with iTunes for Windows and abused the unquoted path vulnerability to evade the detection and maintain the persistence.

Bonjour is an updater mechanism used by Apple to deliver future updates, and it has a separate installation entry to perform a scheduled task.

The BitPaymer ransomware attack was targeting the industries such as finance, agriculture, technology, and is targeting at least 15 organizations.

The unquoted path vulnerability is one of the rarely seen flaws and is well known in the cybersecurity industry for 15 years, which often the vulnerability is used to perform a privilege escalation attack since it exists in a process with admin rights.

 “Software developers are using more and more object-oriented programming, and many times when assigning a variable with a path, they assume that using the String type of the variable alone is enough – well it’s not! The path still needs to be surrounded by quotes (“\\”).” Morphisec researchers says in Blog post.

BitPaymer Ransomware Attack Surface in Bonjour 

Windows users unaware that they need to separately uninstall the Bonjour component when uninstalling the iTunes, but if it is failed to uninstall, then the machine has still allowed the updater task where the vulnerability resides.

Morphisec researchers found that the Bonjour updater is installed on a large number of computers across different enterprises even after they uninstall iTunes from their system.

But Bonjour component remains silently in the system without updates and working in the background. This attack surface motivates attackers to choose this process for evasion.

“As many detection solutions are based on behavior monitoring, the chain of process execution (parent-child) plays a major role in alert fidelity. If a legitimate process signed by a known vendor executes a new malicious child process, an associated alert will have a lower confidence score than it would if the parent was not signed by a known vendor.”

In this case, attackers taking advantage of the presence of Bonjour to perform an attack since the Bonjour component is signed, and known which help to remain undetected.

Basically, a malicious “program” doesn’t come with .exe extension which doesn’t fall under the security software scanning since it tends to scan only specific file extensions to prevent the infection.

“Bonjour was trying to run from the “Program Files” folder, but because of the unquoted path, it instead ran the BitPaymer ransomware since it was named “Program”. This is how the zero-day was able to evade detection and bypass AV.”

Bonjour updater zero-day vulnerability mainly used to evade detection, and there is no evidence found that the BitPaymer ransomware neither writes any files on victims machine nor escalate any privileges.

 Apple patched the vulnerability in both iTunes 12.10.1 for Windows and iCloud for Windows 7.14.  users are highly recommended to update the new version to prevent a future attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates


Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles