Brief #49: Palo Alto XDR Exploit, GPT-4 Vulnerability Exploitation, CISO Insights, and Top Cybersecurity Courses

Happy week 17!

In this week's issues I am covering Palo Alto XDR exploitation to deploy malware, the ability of GPT-4 to autonomously exploit vulnerabilities (should we really be concerned?), the practical applications of AI in security workflows, and insights from industry leaders on navigating the evolving talent landscape and upskilling opportunities.

Let's dive into this week's topics.

Researcher Exploits Palo Alto XDR to Deploy Malware

Shmuel Cohen, security researcher at SafeBreach, reverse-engineered Palo Alto Networks' Cortex XDR and exploited it to deploy a reverse shell and ransomware. XDR solutions require high privileges and access to sensitive information to perform real-time monitoring and threat detection across IT ecosystems. Cohen discovered plaintext Lua files crucial to Cortex's operation and bypassed the anti-tampering mechanism using a hard link to edit the files and load a vulnerable driver, gaining complete control. Palo Alto worked with Cohen to develop fixes but left the Lua files unencrypted, as encryption would not effectively deter attackers. Other XDR platforms may be susceptible to similar attacks.

---

GitHub Flaw Abused to Distribute Malware via Microsoft Repo URLs

McAfee reports a new LUA malware loader is being distributed through URLs associated with Microsoft's vcpkg GitHub repository, making the files appear trustworthy. The flaw allows threat actors to attach malware to any public repository without the project owner's knowledge by uploading files to unsaved comments. These auto-generated download links continue to work even if the comment is deleted, and can be abused to create convincing lures impersonating any company using GitHub. Disabling comments is the only current mitigation, but significantly impacts project development.

---

MITRE Targeted by Nation-State Cyber Attack Exploiting Ivanti Connect Secure Zero-Days

MITRE Corporation revealed it was the target of a nation-state cyber attack exploiting two zero-day flaws in Ivanti Connect Secure appliances starting in January 2024. The intrusion compromised MITRE's unclassified research network called NERVE. The attackers exploited CVE-2023-46805 (CVSS score: 8.2) and CVE-2024-21887 (CVSS score: 9.1) to bypass authentication, run commands, move laterally, and deploy backdoors and web shells for persistence and credential harvesting. MITRE contained the incident and found no indication that its core enterprise network or partners' systems were affected.