More Cl0p Clues and Huge Apple Bug Bounty Changes

But the Oracle e-business Suite obviously is used by a lot of large organizations. And these attacks that apparently began as as early as about mid-july, I think they say July 10, you know, when this vulnerability in, in E-business Suite was a zero day. This is obviously you got plenty of attention. It's a large, large customer base, plenty of targets, potential victims. So the attackers had, you know, plenty of time to get their their act together and get this rolling before anybody really noticed it. And I think Mandiant said that the threat actor was likely exploiting this vulnerability as early as August 9th. So that was several weeks before this patch was available, which was only very recently.

So the window of exposure for this vulnerability was pretty large and there are still many, many exposed instances of e-business Suite out there. Gray Noise has some good data on this if you want to go look at that. So this is something that's ongoing and we know now is was going on for a couple of months before everybody really noticed it, which is kind of concerning, especially when you think about the potential for follow on attacks and ransomware deployments that could come from this.

You know, we may only sort of be at the at the beginning of this, but hopefully the public notice of this and the public or the publicity surrounding it will drive some more patching and more awareness and get organizations to really pay attention to it. That at least that's the that's the hope. Another story that I wanted to mention that has some interesting connections to some previous work that we did on the site is Gray Noise released some data towards the end of this week as well about some surges in scanning for Fortinet, Palo Alto Networks and Cisco devices in for various reasons. If you remember, Cisco notified customers about two zero day vulnerabilities that were being exploited in their ASA appliances.

Recently, you know attackers have been targeting those very popular product. So plenty of attacks surface there and so there's been ongoing scanning for that. And at the same time, Grain always noticed some pretty large upticks in scanning for various Fortinet and Palo Alto network instances. In some cases, they're the attackers are looking for login portals and trying to brute force, you know, the logins for these for these products.

This is, you know, kind of a constant thing that happens on the Internet all the time. And there are various ups and downs with this all the time. But there's some pretty large spikes in the scanning for these in the last couple of days. You know, Gray noises data show like a massive spike in scanning for Fortinet SSLVPNS in the last couple of days of this week. So it's one of those things that organizations should definitely be aware of. If you're deploying these devices, you probably are aware of this already, but it's something to to keep keep in mind.

This kind of activity, as I said, is ongoing almost all the time. And it, you know, it has its ups and downs based on, you know, new disclosures, various vulnerabilities, or just kind of when attackers feel like getting around to it when they don't have other priorities. But it's definitely something to keep in mind if you're using these devices. And as I said, there were also spikes for Palo Alto network scanning as well.

So these are things just to to keep in mind as you're going about your, your work. And kind of the last thing I wanted to mention, describe my attention towards the end of the week as well. Apple put out a relatively rare blog post. They don't. They don't do very much on the Internet, as everybody knows, especially in the security world. They're pretty, pretty tight with their words when it comes to their security work and the way that they handle vulnerability disclosure and various other things.

But they released a long blog post on Friday morning describing some changes and modifications to their bug bounty program. And I would encourage everybody to go read it if you're interested in bug bounties and the way that companies handle vulnerability disclosure and encourage research on their products, which can vary widely from vendor to vendor. As I'm sure you all know, it can vary from actively discouraging researchers to to disclose vulnerabilities to actively encouraging it and offering large bug bounties. And there's a broad middle ground there. A lot of security companies and other tech companies are kind of in that middle ground.

Apple was has had a bug bounty program in various forms for quite a while. It wasn't the broadest one at the beginning. It was relatively narrow and it's still not super broad, but they announced some really large payout changes to what they do have. So previously they had had some, even the previous payouts were very large. Let's be clear about that. Apple pays a lot of money for significant vulnerability disclosures that fit their their parameters.

So the highest level they had previously was a win $1 million maximum payout and that was for a zero click exploit chain. So, you know, a remote compromise of a device with no user interaction. These are the kinds of attack chains that you see from mercenary spyware vendors. These are the things that those companies pay very large amounts of money for and also develop themselves in a lot of cases, but sometimes they buy them from third parties as well.

So Apple is doubling that maximum bug bounty to $2,000,000 for a zero click chain, which is an enormous amount of money obviously. And I'm not aware of any other bug bounty that that is that high, at least not a public one. There may be them, but I'm not aware of them. And Apple also changed several other of their payouts.

So for a one click exploit chain, you know, which just takes one small user interaction, the previous maximum was 250K. That's gone up to $1,000,000. Wireless proximity attack, you know, where you need to be within, you know, sort of close physical proximity of the target device. That also went up from 250K to $1,000,000. An attack with that requires physical device access to a lock device.

It goes from 250K to 500K. You know, still a huge amount of money and an app sandbox, sandbox escape, easy for me to say, goes from 150K to 500K. These are obviously huge amounts of money, and obviously Apple has a huge amount of money and they can afford this. And what's interesting to me, obviously the money is interesting, but the other part that really grabs my attention and should be something that outside researchers should look at is where Apple is choosing to invest this money in these specific areas is a pretty good indicator of where they're seeing attackers invest their time and money. They know how the mercenary spyware vendors operate, what parts of iOS they typically have

success targeting with their exploit chains. And that's where Apple is focusing a lot of their attention because that's where those are the exploit attempts or and actual exploit successes that get the most attention from vendors like Apple, because those are the ones that are the most difficult to find in the wild and also the most difficult to defend against because they typically come from extremely.

You know, I hate the word sophisticated because it's it's kind of a catch all in the security world. But you're talking about the top tier of adversaries that have large budget, large budgets, a lot of technical resources, time and other things to invest in these things. So they know what they're doing is the bottom line. So Apple is focusing their attention on these parts of iOS to harden those. And it's also a good indication of where Apple thinks there's things that maybe they haven't found and maybe outside researchers can find.

There might be a soft spot that maybe they overlooked and maybe the researchers can get to. So there's a, there's a ton of money at stake here. And obviously they don't, these are not rewards that they're going to be paying out on a very frequent basis. You know, they're, they're rare enough that when they do pay them out, you, you probably hear about them. But I think it's an interesting change from Apple because, as I said, they're often not very public about what they do, especially when it comes to device and operating system security.

So it's something to pay attention to when they do make a change like this. So just one of those things I wanted to flag for everybody. There's also a bunch of different, other changes that they're making to the program as well For Mac OS Gatekeeper, they're offering some new bounties there as well in, in some different bounty category. So it's worth everybody checking it out. I'll, I'll put the link in the show notes so folks can go go check it out. But those, those dollar figures really grab my attention. Even for a company like Apple, putting a $2,000,000 maximum bounty on something is not something that they would do lightly.

So it's worth having a look at. Anyway, that's it for this week. Thank you all for for listening. And Oh yeah, or, or just to update everybody on the the new weekly segment. Does Dennis have a dog yet? No, I do not. Still very sad, but maybe one day. But thanks everybody for listening. Have a great week.