Friday, March 29, 2024

Apple iTunes for Windows Zero-day Exploited by BitPaymer Ransomware

Researchers found a new footprint about the recent BitPaymer ransomware campaign that was exploited the Apple iTunes for Windows Zero-day vulnerability to attacker public and private sectors across the U.S.

Threat actors took advantage of a zero-day vulnerability that resides in the Bonjour Updater that comes packaged with iTunes for Windows and abused the unquoted path vulnerability to evade the detection and maintain the persistence.

Bonjour is an updater mechanism used by Apple to deliver future updates, and it has a separate installation entry to perform a scheduled task.

The BitPaymer ransomware attack was targeting the industries such as finance, agriculture, technology, and is targeting at least 15 organizations.

The unquoted path vulnerability is one of the rarely seen flaws and is well known in the cybersecurity industry for 15 years, which often the vulnerability is used to perform a privilege escalation attack since it exists in a process with admin rights.

 “Software developers are using more and more object-oriented programming, and many times when assigning a variable with a path, they assume that using the String type of the variable alone is enough – well it’s not! The path still needs to be surrounded by quotes (“\\”).” Morphisec researchers says in Blog post.

BitPaymer Ransomware Attack Surface in Bonjour 

Windows users unaware that they need to separately uninstall the Bonjour component when uninstalling the iTunes, but if it is failed to uninstall, then the machine has still allowed the updater task where the vulnerability resides.

Morphisec researchers found that the Bonjour updater is installed on a large number of computers across different enterprises even after they uninstall iTunes from their system.

But Bonjour component remains silently in the system without updates and working in the background. This attack surface motivates attackers to choose this process for evasion.

“As many detection solutions are based on behavior monitoring, the chain of process execution (parent-child) plays a major role in alert fidelity. If a legitimate process signed by a known vendor executes a new malicious child process, an associated alert will have a lower confidence score than it would if the parent was not signed by a known vendor.”

In this case, attackers taking advantage of the presence of Bonjour to perform an attack since the Bonjour component is signed, and known which help to remain undetected.

Basically, a malicious “program” doesn’t come with .exe extension which doesn’t fall under the security software scanning since it tends to scan only specific file extensions to prevent the infection.

“Bonjour was trying to run from the “Program Files” folder, but because of the unquoted path, it instead ran the BitPaymer ransomware since it was named “Program”. This is how the zero-day was able to evade detection and bypass AV.”

Bonjour updater zero-day vulnerability mainly used to evade detection, and there is no evidence found that the BitPaymer ransomware neither writes any files on victims machine nor escalate any privileges.

 Apple patched the vulnerability in both iTunes 12.10.1 for Windows and iCloud for Windows 7.14.  users are highly recommended to update the new version to prevent a future attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles