Summary: On November 9th, Intel released a BIOS Reference Code Advisory for two vulnerabilities “discovered by SentinelOne and are tracked as CVE-2021-0157 and CVE-2021-0158, and both have a CVSS v3 score of 8.2 (high)”. The two concerns emanate from insufficient control management and input validation, respectively. An attacker could use these to escalate privileges to a remarkably high level and establish persistence on a machine.

The processors affected were various Intel Xeon Processors, 11th Generation Intel Core Processors, 10th Generation Intel Core Processors, 7th Generation Intel Core Processors, Intel Core X-series Processors, Intel Celeron Processor N Series, and Intel Pentium Silver Processor Series. One key detail is that in order to take advantage of the flaws discovered, an attacker will require physical access to a machine. This gives users ample time to update BIOS and ensure the systems are not vulnerable. However, the 7th generation Intel processors were released 5 years ago. Most motherboard manufacturers do not support BIOS updates that far into the future for a motherboard. As such, some systems may not receive any BIOS security updates leaving users without a viable fix.

Why it matters: As these concerns require an attacker to have physical access to a system, most users and companies might consider this to be a non-threat. However, this highlights the CIA triad tenant of Accessibility. Not only should data be accessible to users, but those who have access is also of vital importance.

Well defended servers are no match to an attacker that can stroll into a server room and plug into the server physically. Physical security is important when cyber security is discussed. Whether security to sensitive areas is by key, access codes, proxy cards, or biometric scanners, having multiple ways of validating a user’s identity before they even have physical access to a machine is vital.

Additionally, just because someone has permission to access a place with higher clearance does not mean that they are authorized to interact with a machine present. Janitorial, maintenance, HVAC, and other staff might be authorized in but not to access a device. A coworker could easily browse the internet using your device resulting in those actions being attributed to you, regardless of how benign the activity. Actions taken by a machine can be attributed to a device, but not always the user at the keyboard. Therefore, it is important that all users lock their devices every time they get up and leave their workstation.

Summary: On November 7, Threatpost reported a sophisticated new threat actor that detects Virtual Machines and other sandbox tools used by researchers to evade discovery and steal credit card information from unsuspecting victims. Magecart is a skimming attack that intercepts the transmission of electronic payment data during online checkout via code injection on vulnerable websites. The script in question performs a browser check to determine whether the host device is a virtual machine by identifying the graphics renderer. If no virtual machine is detected, the skimmer collects the data and sends it to the attacker via a POST request.

Why it matters: Attackers are adapting their techniques to avoid detection by trained professionals. Often times professionals will utilize virtual machines to observe an attacker’s techniques and methodologies, by scanning the system the attackers are able to more accurately determine if they are being observed. Skimmers such as q-logger use encoding and obscure JavaScript to hide their tracks. Additionally, they have adapted to using numerous domains and content delivery networks to hide their origin. Magecart and other injection attacks typically target systems running out-of–date software or insecure code. Be sure to update your systems and employ defense-in-depth as much as possible. Malwarebytes has compiled a list of indicators of compromise (IOCs) associated with a Magecart attack.