GravityZone Control Center Update for September (Read Important Changes)

September 2023 (Version 6.43.0-1)
Early Access
YARA detection rules

YARA rules are queries you can use to scan endpoints for patterns of malicious behavior. Use the YARA detection rules feature to generate custom alerts and security incidents based on the results of these scans.

This feature is available for Windows and Linux endpoints with the following BEST versions:

Windows: 7.9.5.318 or newer

Linux: 7.0.3.2248 or newer

To create YARA rules, go to Incidents > Custom detection rules, click the Add rule button, and then click YARA. Follow the on-screen instructions.

After you create a YARA detection rule, you cannot convert it into another type of detection rule.

From the Custom detection rules grid, you can enable or disable YARA detection rules, or start on-demand scans by clicking the 151926_1.png vertical ellipsis button and then selecting the Scan option.

Clicking a YARA detection rule from the Custom detection rules grid brings up the YARA details panel. From this panel, you can switch to the Search and Incidents sections to view the alerts and incidents generated by the rule.
Unified Incidents

The Parameter filter is now available in the Incidents section. It contains a series of criteria you can use to further filter your grid results and create highly customized smart views.
Improvements
EDR

The Incidents > Custom Rules section has been divided into two sections: Custom detection rules and Custom exclusion rules.

The grids and rule configuration pages have a new design.
Rule settings now include targets. You can now decide whether to apply the rule to the entire company or to specific groups by endpoint tags.

Clicking a grid entry brings up the details panel of the rule. It contains information about the rule, options for navigating rules and for editing the current rule. For custom detection rules, you can use the View alerts and View incidents buttons to switch to the Search and Incidents sections.

In the Incidents > Search section, you can now look up both custom detection rules and custom exclusion rules by using the other.rule_id field in your search query. You can still use the other.exclusion_id field to identify existing alerts for the next 90 days, after which the field will be deprecated.

The Custom detection rules and the Custom exclusion rules sections are now available to Partners even if they do not have an active EDR license on their account.

Partners can now control rules for their managed companies and can use the Company filter in the grid to view the rules created for each company. Customers can also view the rules Partners have applied on their company.

When switching to a new Partner, all custom rules created by the former Partner are disabled. The new Partner will not be able to view the rules applied by the former Partner.

GravityZone platform

Companies switching from a trial license to a monthly subscription will automatically have the Email redaction setting disabled.

New BEST for Linux installation packages are now available for systems with ARM architecture (AArch64).

Minor UI changes to the Add company and Edit company windows, including a different order for the Add-ons displayed in the Licensing tab.

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

RMM Issues Today

CloudFare- Service Outage
Datto Kaseya Firm -Datto BCDR – Users are unable to access the BCDR Status Page
Kaseya – Service disruption for target in DENC DC
Barracuda- UK Region Outage- ECHOplatform and IBU currently unavailable outside North America
Barracuda MSP- US02 – RMM Service Center is moving

 

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

RMM Status and Comments

Over this past weekend 3 RMMS had issues

Connectwise (Still having issues)

Kaseya

Datto

Now my opinion I think you are making a mistake incorporating your AV product with your RMM in 2018 a now large RMM deleted 4000 endpoints of Bitdefender, between my partner and myself we spent a week reinstalling. I had recommended the RMM so I compensated the partner (fyi still my partner) for his time. Now as of today the RMM firm never did repay my firm, and of course I did drop the line publicly.

Key is keep AV seperate, do not be lulled into signing a contract that is not based upon monthly count allowing you to go up and down.

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

Vulnerability: GhostToken vulnerability in Google Cloud

Reported by Colin Domoney Must Read Article1-Aug-25-2023-01-31-48-4868-PM (APIsecurity.io) Great article

This week, we have news of the so-called GhostToken vulnerability, which could allow attackers to target Google Cloud users via the application marketplace. According to the researchers at Astrix who discovered the vulnerability, it could have allowed attackers to access the target account’s Google Drive, Calendar, Photos, Google Docs, Google Maps, and other Google Cloud Platform services. The researchers reported their findings to Google in June 2022, Google accepted them in August 2022, and in April 2023, they released a global patch to address the issue. Researchers also recommended that Google Cloud users regularly verify the application installed on their instance using the application management page on the Google Cloud portal.

The root cause of the vulnerability relates to the manner in which Google Cloud manages the lifecycle of an application and, specifically, how the application’s associated OAuth2 tokens are managed. The Google Cloud provides a 30-day grace period from the time an application is scheduled for deletion until the time it is permanently deleted. This grace period is to allow administrators an opportunity to recover resources deleted in error. While in the pending deletion state, the application (and its associated resources such as OAuth2 tokens) are invisible to platform users. The researchers at Astrix discovered that if an application’s pending deletion was canceled within the 30-day window, then the application and all its associated resources would be restored. They tested this with an OAuth2 token and discovered that this token still provided access to its original resources.

They describe how this delete/pending deletion/cancel deletion loop can be used to effectively hide a rogue application from the application management page of a user’s Google Cloud portal, using the following attack flow:

Article (https://apisecurity.io/issue-227-ghosttoken-on-google-cloud-gartner-on-zero-trust-api-authentication/?_hsmi=271737197&_hsenc=p2ANqtz-9IfgoA5y7vMToerm-_dYKoPrJLUPxYuxFbM8t5n55gQjVb4nUIY4VGKXjHA1ZcwroZuWFiAt3S0OtpnQcQ2GvjR9SmAA)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Software Makers May Face Greater Liability in Wake of MOVEit Lawsuit

Makers of vulnerable apps that are exploited in wide-scale supply chain attacks need to improve software security or face steep fines and settlement fees.
Elizabeth Montalbano Contributor, Dark Reading (August 22, 2023)

Roy Comment great article way to many firms are using “Terms and Conditions on there web sites to try and avoid litigation” Microsoft is a great example, I can name many others that I come in contact with, another example is RackSpace totally hosed the mail world with there security breach Dec 2022. All firms need to be held accountable/and financially for security breaches

A nationwide class-action suit filed against Progress Software in the wake of the massive MOVEit breach could point to additional litigation against software companies whose vulnerable applications are exploited in large-scale supply chain attacks, a legal expert says.

Progress faces claims of negligence and breach of contract, among others, in five nationwide class-action lawsuits filed by consumer-rights law firm Hagens Berman after the Cl0p ransomware gang exploited a critical zero-day flaw in its MOVEit managed file transfer application.

The attack has affected both multinational, high-profile million- and billion-dollar organizations — Shell Oil and British Airways among them — as well as smaller organizations both public and private who deploy MOVEit to exchange sensitive data and large files both internally and externally.

Environments that had vulnerable versions of the software installed exposed sensitive personally identifiable information (PII) of customers, including names, Social Security numbers, birth dates, demographic information, insurance policy numbers, and other financial information.

Hagens Berman claims that in all, Progress has compromised the sensitive personal information of more than 40 million people, and promises that more class actions are on the way as more of the 600 affected organizations come forward.

The suits claim that Progress failed “to properly secure and safeguard personally identifiable information,” thus exposing plaintiffs to “a current and ongoing risk of identity theft” as well as invasion of privacy, financial costs, loss of time and loss of productivity, according to a court filing. Moreover, they face a continued risk that their private information will be misused by criminals.

Depending on how the case proceeds, it could set further precedent for the liability of software providers if and when they fail to fix vulnerabilities in their products before attackers can exploit them and cause data, financial, and other losses for their customers.

Article (https://www.darkreading.com/attacks-breaches/software-vendors-may-face-greater-liability-in-wake-of-moveit-lawsuit?_mc=NL_DR_EDT_DR_weekly_20230824&cid=NL_DR_EDT_DR_weekly_20230824&sp_aid=117842&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=49587)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Hosting firm says it lost all customer data after ransomware attack

Sounds like what could happen to Microsoft O365 and they have no liability (there are inexpensive backup solutions available)

By Bill Toulas August 23, 2023 10:40 AM (great reporting)
Danish hosting firms CloudNordic and AzeroCloud have suffered ransomware attacks, causing the loss of the majority of customer data and forcing the hosting providers to shut down all systems, including websites, email, and customer sites.

The two brands belong to the same company and stated that the attack unfolded last Friday night. However, today’s operational status remains highly problematic, with the firm’s IT teams only managing to restore some servers without any data.

Moreover, the firm’s statement clarifies that it won’t be paying the threat actors a ransom and has already engaged with security experts and reported the incident to the police.

Unfortunately, the system and data restoration process isn’t going smoothly, and CloudNordic says many of its customers have lost data that appears to be irrecoverable.

“Since we neither can nor wish to meet the financial demands of the criminal hackers for a ransom, CloudNordic’s IT team and external experts have been working intensively to assess the damage and determine what could be recovered,” reads CloudNordic’s statement (machine translated)

“Sadly, it has been impossible to recover more data, and the majority of our customers have consequently lost all their data with us.”

Both public notices include instructions on recovering websites and services from local backups or Wayback Machine archives.

Given the situation, the two hosting service providers previously recommended that heavily impacted customers move to other providers, such as Powernet and Nordicway.

Article (https://www.bleepingcomputer.com/news/security/hosting-firm-says-it-lost-all-customer-data-after-ransomware-attack/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

Sneaky Amazon Google ad leads to Microsoft support scam

By Lawrence Abrams August 21, 2023 01:52 PM

A legitimate-looking ad for Amazon in Google search results redirects visitors to a Microsoft Defender tech support scam that locks up their browser.
Today, BleepingComputer was alerted to what appeared to be a valid advertisement for Amazon in the Google search results.
The advertisement shows Amazon’s legitimate URL, just like in the company’s typical search result, as shown below.

These tech support scams will automatically go into full-screen mode, making it hard to get out of the page without terminating the Google Chrome process.
However, when Chrome is terminated in this way, on the relaunch, it will prompt users to restore the previously closed pages, reopening the tech support scam.
A demonstration of today’s fake Amazon Google ad leading to the tech support scam site can be seen below

Google ads abused to distribute malware
BleepingComputer reached out to both Google and Amazon regarding this malvertising but has not received a response at the time of this publication.
Google advertisements have been heavily abused over the past year by other threat actors to distribute malware, which sometimes leads to ransomware attacks.
The threat actors would create replicas of legitimate sites but swap the download links to distribute trojanized programs that install malware.
The Royal ransomware operation also creates Google advertisements promoting malicious sites that install Cobalt Strike beacons. These beacons are used to provide initial access to corporate networks to conduct ransomware attacks.

Article (https://www.bleepingcomputer.com/news/security/sneaky-amazon-google-ad-leads-to-microsoft-support-scam/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient