CyberScotland Bulletin

In Microsoft’s Patch Tuesday for August 2023, they addressed a total of 87 security vulnerabilities. Notably, two zero-day vulnerabilities were being actively exploited and twenty-three were associated with remote code execution (RCE). Out of these RCE vulnerabilities, only six were classified by Microsoft as ‘Critical’ in terms of severity.

The CVE-2023-36884 vulnerability pertains to a remote code execution flaw. This flaw enables adversaries to generate specialized Microsoft Office documents, which can effectively bypass the Mark of the Web (MoTW) security feature. As a result, impacted files can be opened without triggering a security alert, thereby facilitating remote code execution. This vulnerability was actively exploited by the RomCom hacking group. Previously associated with the “Industrial Spy” ransomware campaigns, this group has since rebranded to “Underground”, maintaining its extortion-focused operations.

Another noteworthy vulnerability is CVE-2023-38180, which impacts .NET applications and the Visual Studio environment, making them susceptible to a Denial of Service (DoS) attack. Microsoft has resolved this vulnerability, though the details about its exploitation and the party responsible for its discovery have not been disclosed.

Microsoft users are encouraged to swiftly install the most recent security patches. For a deeper understanding and further details on these updates, users can refer to Microsoft’s official security update guide here.

A newly identified strain of Android malware, CherryBlos, is utilising optical character recognition (OCR) capabilities. This malware’s primary objective is to extract sensitive data from images, specifically focusing on cryptocurrency wallet details. Distributed primarily through deceptive posts on social media platforms.

Upon installation, CherryBlos actively solicits users for accessibility permissions. When these permissions are granted, it takes the liberty to autonomously grant itself even more, further embedding its presence on the compromised device. In a notable defence evasion tactic, users who attempt to remove or shut down the app by navigating to the Settings app are cleverly redirected to the main screen, effectively trapping the malware on the device.

However, what makes CherryBlos particularly nefarious is its two-pronged approach to cryptocurrency theft. First, it overlays deceptive screens atop genuine cryptocurrency wallet applications, enabling unauthorised fund transfers to attacker-controlled addresses. Second, and more uniquely, it deploys OCR capabilities. This allows CherryBlos to scan and recognise mnemonic recovery phrases from images stored on the device—targeting the common habit of users screenshotting their recovery phrases. Once identified, these phrases are periodically transmitted to an external server.

The increasing sophistication of such malware strains has not gone unnoticed by industry giants. Google, for instance, is aware of the risks posed by malicious developers and their propensity to exploit the Play Store. As a proactive measure, they’ve taken steps to reduce the misuse of accessibility APIs by rogue Android applications. The tech behemoth now prevents sideloaded apps from harnessing accessibility features in any capacity.

For users, this episode underlines the importance of vigilance. Downloading apps, especially from unverified sources, necessitates extreme caution. Always verifying developer credentials and perusing app reviews can be the first line of defence against such security risks.