Cyberattacks is becoming a threatening concern in today’s society. Many of us should be aware of the constant cyberattack news spreading around the world with the rising tensions between Russia and Ukraine. Big technology companies such as Google, one of the most popular search engines around the world is making a big investment into the cybersecurity sector. The trillion dollar company has now agreed to purchase the cybersecurity firm Mandiant in an all-cash deal valued at approximately $5.4 billion. Google’s second biggest purchase ever reveals their commitment to investing in the development of cyber security to protect the company and users/consumers from dangerous online threats while using Google Cloud.

Why is Cybersecurity so Important for Companies?

• Cybersecurity is of utmost importance to companies because it allows for private information/data to remain private. Stolen data can lead to lawsuits and a hefty ransom.
• As a company the main goal is to generate income when cyberattacks occur there can be large financial costs that can truly damage a company’s finances. If a company producing products gets cyberattacked that can lead to supply chain interferences digging a deeper hole for the company.
• Lastly, the business model around companies is to provide excellent services to the consumer/user. A companies reputation plays a big role in the ability to draw in consumers. A loss of confidence in the company from consumers would be detrimental to any company. Cybersecurity protects individuals/businesses from private information being accessed, financial bleeding, and loss of consumer trust.

Who is Mandiant and What do they do?

• Mandiant is a cybersecurity firm most known for their efforts in revealing the devastating SolarWinds attack that decimated computers across the United States federal government.
• In Google’s case Mandiant’s operations will require the work of 600+ security consultants and 300+ intelligence analysts on the Google Cloud to create a forcefield security operations suite.
• Services ranging from consulting on cybersecurity to identifying upcoming/potential threats and testing company’s ability to digitally defend.
• Mandiant will help reinforce the dangers foreseen in the cyber security sector following the wave of cyberattacks from Russia and others as the geopolitical tensions rise.

Outlook of Cyber Security for the Future

As mentioned by Mandiant CEO Kevin Mandia in a press statement “There has never been a more critical time in cybersecurity. Since our founding in 2004, Mandiant’s mission has been to combat cyber attacks and protect our customers from the latest threats”. Cybersecurity could be the difference maker where a consumer must choose between two companies that offer a cloud service. Cybersecurity companies such as Mandiant will be looking to “deliver expertise and intelligence at a scale, changing the security industry.”(Kevin Mandia). However, this deal is not set in stone yet as there are antitrust enforcers that could potentially block this deal from concluding. Ultimately cyber security will continue trending upwards as our world continues to be driven by new technologies requiring protection from potential dangers in the world of technology.

References

Grant, Nico. (2022, March 8) Google to Buy Cybersecurity Firm Mandiant for $5.4 Billion. Yahoo Finance. Retrieved from https://finance.yahoo.com/news/google-buy-cybersecurity-firm-mandiant-113342878.html

Ott, Matt. (2022, March 8) Beefing up its cybersecurity, Google buys Mandiant for $5.4B. abc News. Retrieved from https://abcnews.go.com/Business/wireStory/beefing-security-google-buys-mandiant-54-billion-83315471

Vincent, James (2022, March 8) Google is buying the cybersecurity company that uncovered the SolarWinds hack. The Verge. Retrieved from https://www.theverge.com/2022/3/8/22966907/google-buying-mandiant-cybersecurity-outfit-5-4-billion

While file permissions are extremely crucial to the security of Linux systems, a vulnerability has recently been discovered which allows users to bypass these permissions and escalate privileges. A vulnerability called CVE-2022-0847 (nicknamed “Dirty Pipe”) allows people to write to read-only files and fill them with arbitrary information. This can allow someone to completely takeover a system with access to sensitive linux root files. This vulnerability affects Linux versions 5.8 and above.

Max Kellerman, a software developer at IONOS discovered this vulnerability after one of his customers raised concerns about file corruption. Specific files that were downloaded by the customer could not be decompressed which led to this important finding. Apparently, the pipe buffer structure was not properly initialized which led to this kind of file corruption.

What is a Pipe?

In Linux, a pipe is a mechanism that allows for processes on a computer to communicate with each other. It allows users to conveniently send the output of a process into the input of another process. An example of this in the terminal is as follows:

In the above image, the command “cat hello.txt” returns all the contents of the file “hello.txt”. The command “cat hello.txt | head -3” feeds the output of the “cat hello.txt” process into the “head -3” process which returns then the first 3 lines of the input it is given.

How Does the Exploit Work?

There following are the steps used to exploit this vulnerability:

1. Open a pipe
2. Fill pipe with arbitrary data
3. Clear the pipe (this allows for data in the pipe to be merged with other data)
4. Feed in data from the target file into the pipe
5. Write some data into the pipe

As a result of following these steps, the system incorrectly overwrites the cached copy of the target file with data in the pipe. Max Kellermann has written about this in more detail here.

How can this vulnerability be exploited?

The following are examples of exploits:

• Overwriting crucial system files such as /etc/passwd to remove the password of the root user
• Adding ssh keys allowing for remote access to a system
• Overwriting and executing binaries to tamper with the system

Effect on Smartphones

Since the android operating system is built on top of a Linux kernel, there are many questions being raised regarding the security of Android smartphones.  Fortunately, most Android devices use older kernel versions not affected by Dirty Pipe. This vulnerability has been patched for versions 5.16.11, 5.15.25, and 5.10.102.  Google has merged the fixes into the Android kernel however, this does not secure all its devices. The devices likely to be affected are the ones that use Android 12 up. This means that new phones such as the Google Pixel 6 series and Samsung Galaxy S22 are at high risk. For users to stay well informed, it is important to find out about the Linux kernel that their device is using. This can be done by going to Settings > About phone > Android/Software version > Kernel version. IPhone users will be unaffected by this vulnerability as the OS is not built on a Linux kernel.

References

1. https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/03/linux-dirty-pipe-vulnerability-gives-unprivileged-users-root-access/
2. https://redhuntlabs.com/blog/the-dirty-pipe-vulnerability.html
3. https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.androidauthority.com%2Fsamsung-galaxy-s22-vs-google-pixel-6-3103491%2F&psig=AOvVaw0hhkO4k7Cy75Gih82XVKFl&ust=1647452312997000&source=images&cd=vfe&ved=0CAgQjRxqFwoTCJCigqLUyPYCFQAAAAAdAAAAABAD
4. https://thehackernews.com/2022/03/researchers-warn-of-linux-kernel-dirty.html
5. https://9to5google.com/2022/03/14/dirty-pipe-major-exploit-android-12-pixel-6-galaxy-s22/

On the week of March 10, 2022; the FBI issued a warning to the public about the rising amount of malicious phishing scams. Phishing scams are scams where the scammer impersonates someone else, in this case a government official or agency with the aim of getting the victims personal information. Personal information can be used to gain access to vulnerable and private areas that individuals should only keep to themselves. Certain websites that contain personal information require verification and authentication. Some examples can be banking information, medical information and government information. Personal information may range from credit card numbers to SIN numbers, this type of information in the wrong hands could cause one to lose a lot of money or something as dangerous as their entire identity because once security is infiltrated and verification has been subsided, there are no more barriers or obstacles one needs to overcome to access these areas.

The Process of the Scam

The scam usually begins with a call or text from someone who claims to be a police officer or a member of a governmental organization claiming that the victim has committed a crime, missed jury duty, or has missed some kind of payments.The scammer will then try to pressure the victim into revealing personal information and claim that it will be in their best interests to do so. If the victim then refuses to share such information, the scammer will continue to pressure them through the claim of fines, arrest, imprisonment or any number of consequences. Victims will then be offered multiple different ways to settle their dues such as prepaid cards, cash sent by mail, cheque, or wire transfer. The FBI has stated, any government agency or individuals affiliated with them would never ask for money in these forms, so this is the best method to figure out these claims are fake: “officials will never contact members of the public or medical practitioners by telephone to demand any form of payment, or to request personal or sensitive information.”

These scams happen all around the world and have been occurring for a while now, targeting people who aren’t well versed in internet privacy and security. 

How can we Avoid these Phishing Attacks?

• Never pay “government officials” via wiring money, sending cash, using gift cards or cryptocurrency. They would never ask you to pay in such a manner. The ways listed make it difficult to track the money which then becomes near impossible to get back. 
• Never give out any personal information. If you believe that the phone call is real: hang up and call the actual government agency at their number to talk to them. 
• Don’t trust caller IDs. Caller IDs can be faked. I’ve had several scam callers call me, they would hang up (because I’m wasting their time) so when I’d call the same number back my call would go to someone else who didn’t even realize their number was being used. Once they made their caller ID to match an actual government agency and told me to check so I could confirm that the numbers matched. 
• Never click on links from such messages. I usually put it through a link checker such as: www.psafe.com  if I get a message that I think is somewhat dodgy, even from people I know because they might’ve gotten hacked by a scammer. (Most of the time people don’t send links out of the blue). These links are harmful to us because they can infiltrate our privacy and security.

By knowing how to avoid these scams we can ensure our privacy is protected.

Examples

In the example above we can check the following to ensure if this email is real or a scam:

• Check if the agency is real
• Check if the email address matches the actual email address
• Check to see if the link is safe
• Call the agency to ask them about the email, they will be able to verify if it is real

In what ways can we prove or disprove if this message above is legitimate?

Sources:

1. https://blog.malwarebytes.com/scams/2022/03/extortion-fbi/
2. https://www.ic3.gov/Media/Y2022/PSA220307
3. https://abcnews.go.com/Politics/scammers-posing-law-enforcement-extort-personal-information-fbi/story?id=83339242
4. https://www.news-medical.net/news/20220308/Government-strengthens-internet-safety-laws-to-tackle-scams-and-fraud.aspx
5. https://consumer.ftc.gov/articles/how-avoid-government-impersonator-scam

6. https://terranovasecurity.com/top-examples-of-phishing-emails/
7. https://www.bbc.com/news/uk-england-hampshire-52647919

As of late, it seems as though the frequency and prominence of cyber attacks has seen a rise globally. Now in an everchanging and technologically advancing civilization, this should come as no surprise. With that said however, it is still important to be made self-aware of the potential dangers and threats that exist, which leads into the topic of this blog post about MuddyWater.

What is MuddyWater and what has it done?

MuddyWater, also sometimes known as “Mercury” or “Static Kitten”, is an Iranian state-sponsored threat actor, which has been active since at least 2017. In other words, they are a group of hackers who can be attributed to the Iranian government or, more specifically, Ministry of Intelligence and Security; working, in essence, for the sake of furthering the nation’s geopolitical objectives.

In terms of what the group has done, they have been accredited as being the sole cause of cyber attacks on several government owned corporations; whether that may be through phishing tactics or malware. With the majority of these attacks happening within the Middle East and nearby Asian countries. Furthermore, it seems that the frequency of these attacks by the group has seen an increase especially within the past year of 2021, which does raise a few eyebrows out of concern.

Why are they relevant?

For starters, a few weeks back in late February of 2022, warnings had been sent out against the group in response to these global cyber attacks which, as already mentioned, have been occurring more frequently. This in of itself should be cause for some concern, especially given current circumstances regarding the Russia and Ukraine conflicts, where, globally, political tensions are already high enough as is.

More recently, however, the threat intelligence organization Cisco Talos has publicized their findings in regards to their tracing on the activities of the group, which has been happening for over a year now. In their research, it seems that they have traced several campaigns or cyber attacks back to MuddyWater, also analyzing the method of attack and the programming behind it. By doing so, Cisco Talos has deduced that MuddyWater is likely to be comprised of several subgroups, with each based in a different region, that share common interests; in opposition to one larger group who may be entirely based in Iran. A deduction, which potentially exposes the Iranian government, given that several of these cyber attacks that Cisco Talos has analyzed were previously blamed on Western nations for by the Iranian government themselves.

How might this impact the average citizen?

With the recent findings and deductions made, if these do turn out to be true, it certainly would not look good for the Iranian government, which could further damage already dwindling relationships between Iran and other Western nations. Additionally, should MuddyWater consist of several subgroups, it certainly has the potential to make the group a lot more dangerous than they currently are as it introduces the possibility of the group going more widespread than they are now, which may allow for a higher frequency of attacks within places such as North America, Europe, and the remaining parts of Asia as opposed to just the Middle East and places nearby. Not to mention that while the usual victims do tend to be governments or government owned corporations, the possibility that an average citizen also becomes a victim as a side effect always exists, especially given that they have used widespread scam tactics, such as phishing, before.

References

• https://www.govinfosecurity.com/iranian-apt-new-methods-to-target-turkey-arabian-peninsula-a-18706
• https://thehackernews.com/2022/03/iranian-hackers-targeting-turkey-and.html
• https://www.techrepublic.com/article/muddywater-targets-middle-eastern-and-asian-countries-in-phishing-attacks/
• https://blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html

According to the Russian government, unknown attackers hacked the stats widget used by various government institutions to count the number of visits on Tuesday, March 9th, 2022, compromising the websites of some of Russia’s federal agencies. The attackers uploaded their own content and barred access to the websites, which was detected Tuesday evening.

What is supply chain attack

A supply chain attack is a form of cyberattack that tries to cause harm to a company by exploiting weaknesses in its supply chain. In order to implant rootkits or tie in hardware-based espionage features, cybercriminals frequently modify hardware or software during the manufacturing stage. Attackers can then employ these implants to assault the target organization.

Counter attacks

Meanwhile, attackers used the ‘RURansom’ malware in an attack against Russian sites. RURansom, despite its name, is more of a data wiper than ransomware in the purest sense because it discards the independent and individual encryption keys required to encrypt each file as it spreads, according to a Trend Micro write-up on the threat. “This is a wiper,” Trend Micro explained to The Daily Swig. “Encrypted files are deleted, and recovery is only possible from a backup, if [they] exist.” Several versions of the virus check to see if the target machine is in Russia before starting the infection and file destruction procedure, showing that it is targeted. The software is explicitly designed to harm Russia, according to a letter left on infected PCs.

It’s unclear how many computers have been infected by the Windows-specific RURansom malware. “We have not seen any targets in our user base based on our telemetry,” Trend Micro informed The Daily Swig.

What happened?

Several Russian government websites were breached via a supply chain assault. The cyberattack impacted the websites of the Energy Ministry, the Federal Governmental Statistics Service, the Federal Penitentiary Service, the Federal Bailiff Service, the Federal Antimonopoly Service, the Culture Ministry, and other Russian state agencies.

The Russian Ministry of Economic Development’s press office told Interfax that hacking these websites directly is hard, so hackers utilize other services to gain access to the resources and present erroneous information. After getting access to the widget, hackers were able to post bogus information on websites. The problem’s source was promptly determined.

State agency websites are heavily guarded and monitored by cybersecurity professionals 24 hours a day, seven days a week. Because it is impossible to directly penetrate these websites, hackers use external services to attack resources and gain access to show false information.

Ukraine and Russia are aiming their missiles against one other’s networks.

This follows the Russian government’s release of a list of over 17,000 IP addresses suspected of being used in DDoS assaults against Russian networks. Russian organizations were advised by the Federal Security Service’s National Coordination Center for Computer Incidents (NKTsKI) to take precautions against threats to their information security and gave guidelines on how to protect against such assaults.

These warnings came after Ukraine’s Vice Prime Minister, Mykhailo Fedorov, declared the formation of a “IT army” to aid the country’s “cyber-front combat.” The Ukrainian IT Army was formed after the Ukrainian Défense Ministry began recruiting members of Ukraine’s underground hacker community to launch cyberattacks against Russia in response to a “massive wave of hybrid warfare.”

On Monday, Russia’s Digital Development Ministry dismissed allegations that the country was planning to disconnect from the internet. “Cyberattacks on Russian websites are ongoing from all over the world. We are preparing for a variety of scenarios in order to ensure that Russian [online] resources are accessible. Inside [the country], there are no intentions to turn down the internet .

Russian Government’s response.

The Russian government has released a list of 17,576 IP addresses that are suspected of being used to perform distributed denial-of-service (DDoS) attacks against Russian organizations and networks. The list was shared by Russia’s Federal Security Service (FSBNational )’s Coordination Centre for Computer Incidents (NKTsKI), along with advice on how to protect against the assaults and a second list with attackers’ referral domain information.

Source:

According to the Russian Ministry of Digital Development, the compromised websites of state agencies were restored within an hour of the attack, according to BleepingComputer.

More than 17,000 IP addresses suspected of being used in DDoS attacks on Russian networks were recently published by Russian authorities.

As a result, the NKTsKI, a federal security agency section entrusted with coordinating computer incident response, issued a public warning to Russian firms about the threat of data breaches.

Earlier this week, Russia’s Digital Development Ministry denied allegations that the country was planning to cut itself off from the Internet.

https://www.bleepingcomputer.com/news/security/russia-shares-list-of-17-000-ips-allegedly-ddosing-russian-orgs/

https://www.bleepingcomputer.com/news/security/russian-government-sites-hacked-in-supply-chain-attack/

https://heimdalsecurity.com/blog/ddos-attack-distributed-denial-of-service/

https://www.ft.com/content/a8e7c9a2-5819-424f-b087-c6f2e8f0c7a1

https://portswigger.net/daily-swig/stats-widget-hacked-in-attempt-to-breach-russian-government-agency-websites

On March 3, 2022 Ukrainian hacker and REvil member Yaroslav Vasinskyi was extradited to the United States, and will be facing trial in Texas for his role in ransomware attacks against American companies. A statement by the U. S. Department of Justice (DOJ) reads: “Vasinskyi is charged with conspiracy to commit fraud and related activity in connection with computers, damage to protected computers, and conspiracy to commit money laundering.” If he is found guilty, he could face up to 115 years in prison.

According to the indictment released last July by the DOJ, Vasinskyi has been part of REvil since at least 2019 and has launched around 2,500 attacks. Among these many attacks includes the July 2021 ransomware attack on the American software firm Kaseya.

The Kaseya ransomware attack

Kaseya is a Florida based company that primarily helps small to medium businesses (SMBs) across the world manage networks managing networks, systems, and information technology infrastructure.

Kaseya’s services are managed remotely by Kaseya Virtual Storage Appliance (VSA), which allows customers to use virtual machines for storage instead of buying hardware. On July 2, 2021 unusual behavior on the endpoints of clients’ networks was reported to Kaseya: it turned out hackers had found out a way to bypass the authentication of the VSA and distribute REvil ransomware through the hosts managed by the software. Within a few hours Kaseya shut down their VSA cloud servers and issued out a statement to its clients, however the damage had already been done. The effects of this attack were felt internationally; up to 1,500 companies across the world were affected. REvil took credit for the attack, and demanded $70 million for a decrypting key that would unlock all infected systems. Kaseya refused to pay the ransom, and in a statement made on July 22, 2021 the company declared that it had obtained a decryptor key from an anonymous third party, which was later revealed to have been the FBI.

Effects of the attack

The effects were felt by thousands of companies internationally. Virginia Tech University was affected, and many schools and kindergartens in New Zealand were also affected. In Sweden, the superstore chain Coop was unable to use its cash registers, and had to shut down its over 800 locations for a few days.

The US Government’s response

In August 2021, the US Department of Justice released an Indictment for Vasinskyi, connecting him as well as Russian hacker Yevgyeniy Polyanin with the Kaseya attack. In fall of 2021 Vasinskyi was arrested in Poland, and held there until his extradition to the US. While Vasinskyi is not a US citizen, the US government has made it clear that they will prosecute cybercriminals regardless of nationality. Attorney General Merrick Garland declared in a public statement: “The Justice Department will spare no resource in identifying and bringing to justice transnational cybercriminals who target the American people”.

Hopefully this trial will help dissuade international hackers from engaging in ransomware, as it is sad when a small group of malicious actors are able to cause such a disruption to thousands of innocent people across the world. Companies and individuals certainly do have a responsibility to ensure that they always use best security practices, however governments also have a responsibility to bring justice to hackers who do break into systems and cause harm to companies and individuals across the world.

References

Alleged Ukrainian hacker in US court after extradition from Poland (msn.com)

Alleged Ukrainian Member of REvil Ransomware Gang Extradited to US (hackread.com)

Kaseya ransomware attacker’s trial begins – Security – iTnews

Sodinokibi/REvil Ransomware Defendant Extradited to United States and Arraigned in Texas | OPA | Department of Justice

Important Notice August 4th, 2021 – Kaseya

Kaseya denies paying ransom for decryptor, refuses comment on NDA | ZDNet (archive.org)

Up to 1,500 businesses affected by ransomware attack, U.S. firm’s CEO says | Reuters

Kaseya VSA ransomware attack – Wikipedia

REvil member accused of Kaseya ransomware attack arraigned in Texas (cyberscoop.com)

Lessons Learnt from the Kaseya Ransomware Attack – Pragma – Securing Your Digital Future (pragmastrategy.com)

Innovative modern technologies over the last few decades have not only made our lives easier, but also increased the potential for threats. In 1975, renowned engineer and businessman Gordon E. Moore predicted that the computational power would double every 2 years over the foreseeable future, which had later been termed as the “Moore’s Law”. It had been growing exponentially ever since and along the line, we are currently in the beginning of the Quantum Computing era. It is a kind of computation that exploits the properties of quantum states like superposition, entanglement, and interference in a collective way to perform calculations. The devices that do this are called “Quantum Computers”. They have the capacity to outperform even the best supercomputers.

Why is it a threat?

The world’s data are being protected by modern public key encryption algorithms to transmit data over the internet in a secure way. Some of the examples are RSA, Elliptic Curve and ElGamal. They have brought about revolutionary improvements to information security, enabling digital communication, e-commerce applications and accessibility of remote financial services. But just as the World War 2 code breakers developed a system to defeat Enigma, quantum computers are one such technological threat.

Although they can’t currently break public key encryption, they are not far behind. They can be weaponized in the wrong hands and in as nearly as 5 years, they could disrupt the entire cyber security space, posing massive business risks. An algorithm called “Shor’s algorithm” is exponentially powerful than classical algorithms and with a large enough quantum computer, it can potentially expose and crack daily encryption mechanisms like Transport Layer Security (TLS) and Virtual Private Networks (VPN). Hence, organizations need to start thinking about enhancing their security measures starting now. Information that needs to be available securely in 5 years or more should be protected now. US National Institute of Standards and Technology (NIST) is actively working on developing the next generation of cryptography.

Financial institutions in specific have long been the primary focus of attackers. With the introduction of digital banking, the number of sophisticated cyber-attacks has significantly increased. Based on a report from Trend Micro, the ransom-ware attacks on banks have increased by 1,318 percent year on year in the first half of 2021. This could have a great impact on the American economy. A Hudson Institute study revealed that if the access to the Fedwire Funds Service, a real-time GSF transfer system, from any of the largest financial institutions is disrupted by quantum computers, it could lead up to $2 Trillion in loses.

Measures to ensure post-quantum cyber security

In a congressional hearing last year, all 6 CEOs of the major financial corporations testified positively about cyber security being the largest threat to the economy. This prompted the various governing bodies in America such as the NIST and FBI to take necessary precautions. And recently, the white house also issued a memorandum outlining the terms to overcome this threat which was titled “Post-Quantum Cybersecurity (PQC mandates)” for the National Security Agency (NSA). Another huge developed that has happened was discussions on securing NATO’s post-quantum era communications. Their security centre is run by the NATO Communications and Information Agency (NCI Agency), providing 24/7 protection. In partnership with the white house, a UK based post-quantum provider “PQ” has successfully performed testing trails on communication channels in a quantum environment using a Virtual Private Network called “Hybrid Post-Quantum VPN”. This move is crucial to maintain stability in quantum era warfare.

The market for quantum secure solutions is valued at $9.5 Billion by 2029. PQ itself has been involved in R&D for a long time and offers a variety of quantum solutions from IOT to end-user applications and mobile services. Some of the other promising providers in the field are QuintessenceLabs and Crypta Labs. The former is based in Australia and has recently raised A$25 Million in funding to provide quantum-safe solutions and has also won the prestigious CyberTech100 award in 2020. The later is UK-based and raised $7.4 Million in seed funding a couple of years back. It has developed the world’s first Quantum Random Number Generator that is space compliant for securely encrypting satellite data.

Fighting quantum with quantum

So, how can quantum safe algorithms be designed? Well, with the help of quantum cryptography of course! It uses principles of quantum mechanics to encrypt and transmit data in order to prevent even the hackers with quantum computers. Unlike traditional mathematical encryption schemes, this is virtually unbreakable. This is one of the promising avenues being explored at the moment to achieve highest levels of security.

Thus, in the near future, quantum cyber security is expected to act as a pillar for securing digital information across networks for all cryptographic algorithms while organizations made a steady head way towards the adaptation.

References

Post-Quantum secures NATO’s communications for the quantum era

NATO and White House recognize post-quantum threats and prepare for Y2Q

https://www.businesswire.com/news/home/20220308005005/en/QuintessenceLabs-Secures-Further-Funding-to-Scale-Its-Advanced-Quantum-safe-Data-Protection-Capabilities

https://securitytoday.com/articles/2022/03/07/banks-need-to-act-now-to-ensure-postquantum-cybersecurity.aspx

https://www.weforum.org/agenda/2020/06/quantum-computers-security-challenges/

https://post-quantum.com/about/index.html

https://www.qmunity.tech/post/quantum-cryptography-explained

https://quantumxc.com/blog/quantum-cryptography-explained/

On Tuesday of this week, Mozilla released a patch for Firefox that removed a pair of use-after-free bugs from the browsing software. These zero-day bugs allowed attackers to abuse thread shutdowns and text reflows to escape from the security sandbox and possibly launch RCE attacks on victims. There was also another bug that was patched that had allowed users to escape from the security sandbox using an iframe. This bug could then be used to launch an attack through the code that had previously been trapped in the sandbox but is now free to wreak havoc.

What is Use-After-Free

So what exactly is a use-after-free bug? Well, a UAF occurs when a register within the heap memory of a program is emptied, but not set to null. When this happens, it allows a knowledgeable user to access that register and insert their own data into it. An attacker can then use this vulnerability to insert malicious code into an instance of the heap, allowing them to release said malicious code from the confines of the security sandbox. This would allow for an attacker to launch Remote-Code-Execution attacks, or RCE’s for short, on the victim’s computers if they access the “empty” register during their browsing.

What is the security sand box and why does it matter

At this point, I have also made several references to the security sandbox, so what is that? The security sandbox works similarly to a virtual machine, in that it emulates the environment of a host device while keeping all programs executed within the sandbox environment from escaping onto the user’s primary system. With this in mind, we can simulate the threat that escaping the sandbox poses with an example. Imagine, for the sake of argument, that you filled a physical sandbox with bleach. That bleach is only able to attack whatever you put in the sandbox, but can’t burn any of the grass laying just beyond the border. However, if you were to poke a hole in the side of the sandbox, then all that bleach would flow out and ruin your garden.

Now, let’s take our example and apply it to a computer, but instead of bleach, we have a malicious virus ready to eat away at our private data. The same problem occurs when a hole emerges, through the use of one of the UAFs or the iframe bug. Now, instead of a garden getting turned into no-man’s-land by bleach, your computer has been infected with a virus. This is the risk that these bugs, which have thankfully been fixed, could cause.

So What Now?

These three bugs mentioned already aren’t the only sandbox breaking holes that Firefox has sealed up in recent history. Only this past Saturday, Firefox released another patch that fixed a different pair of UAFs that were even more dangerous than the two mentioned above. If it weren’t for the bounty hunters that found these bugs, or who are credited for bringing them to Mozilla’s attention, these bugs could have caused a lot of serious issues for the general public. How swiftly Mozilla worked to patch these bugs once they were brought to their attention just goes to show that cyber security is higly prioritised. Their team is working hard to bring its users a safe environment to use for scrolling about the near-infinite realm known as the internet.

Resources:

https://www.firewalls.com/blog/security-terms/use-free-uaf/#:~:text=Use%20After%20Free%20(UAF)%20refers,been%20assigned%20to%20another%20application.

https://encyclopedia.kaspersky.com/glossary/use-after-free/

https://threatpost.com/firefox-zero-day-bugs-rce-sandbox-escape/178779/

https://www.forcepoint.com/cyber-edu/sandbox-security

https://www.mozilla.org/en-US/security/advisories/mfsa2022-10/