Fluent Bit Flaw Is Risky for Cloud Providers

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Fluent Bit contains a flaw, Microsoft is nuking VBScript, Irish police and the SEC face fines, a man was sentenced for BEC, a flaw was found in Netflix’s Genie, an Australia university said it was breached and Black Basta claimed an attack, and hacker Alcasec was arrested again.

See Also: Supporting Malware Analysis at Scale

A memory corruption vulnerability in Fluent Bit, an open-source telemetry agent used by many cloud services to monitor infrastructure, allows attackers to execute denial-of-service attacks, disclose information or execute remote code.

The flaw, named Linguistic Lumberjack by Tenable researchers and tracked as CVE-2024-4323, affects versions 2.0.7 through 3.0.3.

Fluent Bit is embedded in major Kubernetes distributions from Amazon AWS, Google GCP, and Microsoft Azure and has been downloaded more than 13 billion times.

The vulnerability in Fluent Bit’s built-in HTTP server allows improper input validation, leading to memory corruption. Exploits could crash services or leak sensitive information.

“The identified vulnerability arose from a memory corruption error that could potentially create conditions for denial of service events, information disclosure, or, with an extremely sophisticated attack, remote code execution. This issue was related to the internal tracing interface and not to traces telemetry data handling,” Fluent Bit said.

The Fluent Bit team fixed the issue in the main branch, and the official patch is expected in version 3.0.4.

Microsoft said Wednesday that VBScript will be available as an optional feature on Windows 11 starting in the second half of 2024, and its permanent removal is set for a still-to-be-determined date. The company said it will turn VBScript on by default until sometime “around 2027,” when it will switch the default setting for VBScript to “off.”

“This means that if you still rely on VBScript by that time, you’ll need to enable the FODs to prevent your applications and processes from having problems,” the company said.

The operating system giant in October 2023 telegraphed its intention to phase out the programming language that has served as a pathway for Windows hacking. Trojans including Emotet and Qbot – also known as Qakbot – have spread via VBS. The notorious ILOVEYOU worm from the year 2000 was a VBS file.

Users who still depend on VBScript should migrate to JavaScript or PowerShell, Microsoft said.

The British data protection watchdog said Thursday it provisionally intends to fine the Police Service of Northern Ireland 750,000 pounds for exposing in August the identifying information of all officers and staff.

U.K. Information Commissioner John Edwards cited “tangible fear of threat to life” as the reason for the fine.

The police service inadvertently posted online for several hours a spreadsheet containing the first initials and surnames, roles and locations of police. Days after the breach occurred, officials warned that dissident republicans opposed to the power-sharing agreement that ended decades of ethno-nationalist conflict in Northern Ireland possessed the spreadsheet. Many police officers and civilian employees, especially members of the Catholic community, publically hide their employment (see: Northern Ireland’s Police Service to Revamp Cybersecurity).

The proposed fine would have been 5.6 million pounds, but the Information Commissioner’s Office reduced it to avoid diverting public funds, the office said.

The PSNI has 28 days to respond. Deputy Chief Constable Chris Todd said in a statement that the PSNI has arrested individuals who are allegedly in possession of the spreadsheet, in an investigation that’s ongoing. Todd also said the police agency accepts the ICO’s findings but will discuss the fine amount, given the amount it’s already spent on improving security.

The Intercontinental Exchange Inc., which owns the New York Stock Exchange, will pay a $10 million penalty for failing to promptly report a 2021 cyber intrusion. The U.S. Securities and Exchange Commission found ICE violated Regulation Systems Compliance and Integrity by not informing its subsidiaries of the breach in time.

The delay prevented the subsidiaries from meeting their disclosure obligations to the SEC. Hackers exploited a zero-day vulnerability in the VPN used by ICE and installed malicious code. ICE and its subsidiaries agreed to the SEC’s order without admitting or denying the findings.

An Atlanta federal judge sentenced a Georgia man to 10 years in prison and ordered him to pay $2.6 million in restitution to victims of his business email compromise and romance scams. Malachi Mullings, 31, pleaded guilty in January 2023 to all eight counts of his indictment, which stem from money laundering and conspiracy and concealment of money laundering.

From 2019 to July 2021, Mullings laundered more than $5.4 million in fraudulent proceeds through 20 bank accounts, including criminal takings from a healthcare benefit program and individual victims, many of them elderly. Prosecutors said he spent $260,000 on a Ferrari after obtaining the money from a romance scam. He attempted last year to withdraw his guilty plea through a pro se pleading that the court rejected.

Mullin’s prosecution was part of a concerted effort by the federal government to crack down on BEC scammers who target public and private health insurers.

The FBI’s most recent annual report of internet crimes says the bureau received complaints about BEC crimes with adjusted losses totaling more than $2.9 billion in 2023. Business email compromise is a mainstay of social engineering fraud, whether it’s conducted through spoofing a legitimate address or hacking into an inbox.

A critical vulnerability in Netflix’s open-source Genie job orchestration engine potentially allows remote attackers to execute arbitrary code.

Researchers at Contrast Security discovered the bug, which is tracked as CVE-2024-4701 and has a near-maximum severity score of 9.9 out of 10 on the CVSS scale. The vulnerability exploits a path traversal flaw during file uploads, enabling attackers to access and manipulate files outside the intended directories.

Though Netflix’s internal systems and products are unaffected, other organizations using Genie OSS without adequate mitigations are at risk. Netflix has patched the vulnerability.

Australia’s Western Sydney University notified 7,500 students and academic staff on Tuesday about a data breach involving unauthorized access to its Microsoft 365 and SharePoint environment.

The breach, identified in January, occurred on May 17, 2023. Intruders accessed email accounts and SharePoint files, potentially through the university’s Solar Car Laboratory infrastructure. Western Sydney University has 47,000 students and more than 4,500 staff.

The university said it shut down the intrusion, launched an investigation and implemented remediation measures. NSW Police and the NSW Information and Privacy Commission are involved in the ongoing investigation. The university obtained an injunction from the NSW Supreme Court to prevent the misuse of the compromised data.

The Spanish National Police again arrested José Luis Huertas, known as Alcasec, Spain’s most notorious teenage hacker, multiple Spanish newspapers reported Wednesday, citing sources close to the investigation.

El Confidencial reported that the Tuesday arrest is related to the alleged theft and sale of hacked data for which the 20-year-old hacking prodigy hasn’t yet been charged. ABC reported the charges stem from an alleged cybercrime revealed by analysis of Huertas’ devices seized by police in April 2023, when police arrested him for allegedly hacking a governmental information hub through which he allegedly stole data from the Spanish tax agency belonging to nearly 600,000 individuals (see: Spanish Police Arrest ‘Dangerous’ Teenage Hacker).

A Spanish court granted Huertas provisional liberty last May after he cooperated with authorities and disgorged approximately 1 million euros worth of bitcoin obtained by selling stolen data. Spanish prosecutors have asked for a prison sentence of three years.

Huertas earlier this year told El Confidencial that a monthlong stay in a high-security prison reformed him and that he would now be helping cyber defenders (see: Breach Roundup: Catching Up With Alcasec, Spain’s Most Dangerous Hacker).

ABC reported Tuesday that this latest incident is the sixth time police have arrested Huertas. He has served time in a semi-open juvenile detention center for hacking into the city administrations of Granada and Madrid to steal 53,000 euros. As a teenager, he gained fame for creating over 150,000 free HBO accounts and manipulating Burger King’s ordering system to offer free food.

Other Coverage From Last Week

With reporting from Information Security Media Group’s David Perera in Washington, D.C.