The LogicHub Security Roundup: November 2021 Edition

WHAT DOES IT DO?

The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.

WHAT DOES IT DO?

A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user. This vulnerability is due to a weakness in the SSH subsystem of an affected system. An attacker could exploit this vulnerability by connecting to an affected device through SSH.

WHAT DOES IT DO?

The Ethereum cryptocurrency operates using a ‘proof of stake’ consensus system, which confirms transactions across the blockchain. Through October 19, 2021, two attacks were presented against Proof-of-Stake (PoS) Ethereum: one where short-range reorganizations of the underlying consensus chain are used to increase individual validators' profits and delay consensus decisions, and one where adversarial network delay is leveraged to stall consensus decisions indefinitely. Combining techniques from both refined attacks creates a third attack which allows an adversary with vanishingly small fraction of stake and no control over network message propagation (assuming instead probabilistic message propagation) to cause even long-range consensus chain reorganizations.

SUMMARY

Developed in the wake of a series of DNS blunders and attacks, our engineering team produced some excellent monitoring solutions for AWS Route 53. This AWS service is a high availability scaling cloud DNS service that allows for easy monitoring, such as through LogicHub.

AUTOMATED SOLUTION

By pulling in logs from Route 53, we can run three different detections:

• AWS Route 53: Domain Resolving to Suspicious IP, uses our geoIpLookup() to verify the resolving IP is not a TOR node, VPN or anonymous hosting provider
• AWS Route 53: Suspicious DNS Response, checks for one of the following server responses “SERVFAIL”, “NOTIMP”, “REFUSED”, “YXDOMAIN”, “XRRSET”, “NOTAUTH”
• AWS Route 53: Domain Name Resolving to New Host Provider, checks 30 days back and compares the whois organization result for where the resolving host is to make sure a service hasn’t changed hosting. URL resolves to AWS but suddenly resolves to IT Services in Romania would raise an alert.

These detections can vastly improve the way your DNS security works with very little work. Any LogicHub customers paying for detections have access to these detections.