The Canvas Attack, Ivanti and Palo Alto Exploits, and Dirty Frag

I, I mean like thousands and thousands and thousands of organizations use this system that, you know, in various ways. It's a SAS system. So what seems to have happened is in the first I heard about this was I think on Wednesday sometime or maybe even Tuesday, somebody put a screenshot in a Signal group that I'm in with a bunch of security researchers and CSO's and folks like that of an e-mail that they got from their kids school saying, hey, just so you know, Canvas is down because of this. And they didn't specify what exactly had happened. I think they said it was a cybersecurity incident or something like that.

Very quickly people connected it to shiny hunters and turns out shiny hunters compromised in structure in some way. Haven't seen any definitive public statements from that company yet. They're, they've had, you know, you can go and look at their status page and it shows like what's up and what's down. And they, they ended up putting their, a bunch of these products into maintenance mode yesterday because of this, this breach. But I, I can tell you that some of the folks that I'd like it's finals week for colleges here in the United States and people were getting pop up notices of the shiny hunters. We hacked your school essentially message during exams like in the last couple of days.

So, you know, during a final exam, which depending on how much you know, how much you like school is either a really great thing or a really bad thing for you. Like, I mean, either you're like, oh, thank God, I don't have to take this exam. Damn. But it, I mean, it's I, I saw an estimate yesterday that it was over 9000 schools. Yeah. Which is an insane number. Like that's crazy. Yeah, that's a lot. And it's like you said, it's one of those things where because it was so disruptive, especially yesterday during exams, we're hearing about it.

It's getting a lot of broad coverage and kind of more of the non tech publications, but we're also like getting texts from families and friends who heard about this. And so the timeline of on this was interesting too 'cause like you mentioned, this started before it really escalated with that, with the pop up yesterday, I think that instructor had disclosed that about the unauthorized access like earlier in May. But then this week was when it really escalated dramatically and like, I feel like the spread actors were probably waiting for a time to be as most disruptive as possible, especially with exams happening.

Great. What it seems, yeah. Yeah. So that's that's an interesting aspect of it as well. Yeah, mission accomplished on that, on that front, unfortunately. I mean, it's, I don't really know how the individual schools or school districts can respond to this or what they can do immediately. Because if you're trying to wrap up final exams and, you know, kids are going home for the summer, like today or this weekend, how do you say, oh, hey, listen, 10 days from now you have to log back in and, you know, retake this exam or restart it or whatever.

You know, a lot of these kids are going to be in internships or they're going to whatever the case may be. You know, it's probably easier in a high school situation, but like, I, I don't know. And there's not much that these individual customers can do about it because this is, you know, above their pay grade. It's at the provider level. They can't really respond to it in any technical way. It doesn't seem like because it's, you know, it's a SAS system. Right. Yeah, It, it reminds me, do you remember the power school breach in 2024 or two years ago? Yeah.

So that was similar, which is there is the this power school, like I guess it's a customers it, it basically is a system used by a bunch of schools more at the, I think high school level for that one. But it was one of those ones where that system got breached and then it had all these impacts on the downstream customers using it. And you know, it really varied by school district.

But like, that was one of those ones where like I heard a bunch of school districts in Massachusetts got popped because because literally we were hearing about it in our local news. Yeah, that's true. Yeah. I haven't seen this on like anywhere local, although they're, you know, we're both Massachusetts. There's a bunch of schools here that are on the list of, you know, both school districts and universities. There's 1000 universities in Massachusetts and they all seem to be on that list unfortunately. Yeah.

I do remember during COVID when every kid was remote learning, there was some of these shenanigans going on too. Not to this level, but there was, you know, probably high school kids themselves like knocking their, you know, remote learning system offline or things like that, but nothing on this scale. Yeah, Yeah. That's it is interesting like with the schedule of school like in the fall, there's always kind of an uptick that we see in you know, either emails that are targeting phishing emails targeting kind of school staff or just like these ransomware attacks targeting schools because that's when it's most disruptive so. Yeah, so that's fun.

Yeah, yeah. Forget snow days, now we have, I mean, it's more days or whatever this is. We have somewhere. Days. What have we done? It's Yeah. Yesterday was just a crazy day all the way around. I mean, the day was basically over, and then you and I were just texting each other about like, oh, have you seen this? Wait, did you see this? Oh wait, there's another like branded Linux bug. Oh, wait, but there's this Avanti one and there's this canvas thing going on all in like a 45 minute period that was just really kind of crazy.

And it, you know, it, we were talking about it yesterday and it, it reminds me of like 10 or 15 years ago when there was all kinds of just like nonsense going on with the Anonymous and Lulsec and all those kind of groups that were, you know, essentially like just mischief makers. Like they did some, you know, there was some definite like they caused some damage, but it was not what we're seeing now. This was before ransomware really had taken hold.

And it was, I mean, a lot of it was like very silly, juvenile stuff. But there was also some real, you know, they doxed a bunch of people. It was some of it got ugly, but the stuff that's going on now is on a far larger scale and there's so much more money involved that it's just, it's crazy, you know? And there's you can, you know, I was texting with one of our friends yesterday. I was like, these people needed somebody's got to get them. And, you know, he was like, yeah, but there's always another group of people right behind them ready to, you know, step in.

You know, it's not like you're not going to root out the problem by getting two or three of these guys. Unfortunately, it's hard. I think the fact that there's so many different groups now that are the collaboration, I guess that's happening is really what's making this tricky. It's because it's not like these are working in silos. Like, you know, if you look at like Shiny Hunters or Scattered Spider, all these different groups, like there have been different partnerships that have happened between or affiliations and you have like ransomware affiliates and all of that.

So there's so much. I think there's so much of that collaboration that it's really paying off for them, unfortunately. Oh yeah, They're all sharing tactics and tools and learning from one another and all of that kind of stuff. And there's so many targets. It's not like they are stepping on each other's toes. They can just be like, oh, this worked for us over here. Let's try to you guys can try it over there. It's yeah, it's it's wild. It's a crazy, crazy time. Yeah. And then you have like these Palo Alto and Avanti bugs that make it especially easy for these guys because. I just.

Just there so I. Can't it, I do feel, I mean, we joke about this being the Groundhog Day scenario with these edge security devices all the time and we like to laugh about it or whatever, but it's just, I don't understand the scale of how many bugs are in these boxes that are supposed to be protecting your network. And I have a feeling that, I mean, we're talking about two different bugs.

One was in a Palo Alto in their Pan OS software that runs a bunch of their like firewall and other security devices on the edge. And another one was an Avanti bug. It's not in an Edge device, but it's in like their EPMM products. But the larger point is I think we're going to, I think we're on the precipice of seeing absolute waterfall of these things now with all the LLM assisted research.

Because a lot of times what you see is we'll talk about this with that, that Linux bug in a second. But you'll see someone or something finds one of these vulnerabilities, you know, saying in Pan OS and then all of a sudden there's a cluster of them around like similar or connected bugs around that one because people are looking at a new place or they have a, you know, some creative idea or something. That's something that AI models excel at. You know, you point them at a target and say, go find vulnerabilities like this in this software or in this, this competitive software.

That's what those things do really well. Yeah, it's so true. Yeah. And I feel like we see those edge device flaws so, so much and we have seen them over the past few years because of like the way that they're designed and developed is inherently difficult to protect them, which is ironic because a lot of the times they're, you know, made as security products, But I mean, they're like, it's really like a hacker's dream.

Like they're directly, you know, a lot of the times exposed to the Internet, like they're running like kind of these old complicated, like code bases. And then also they're just like, they have like limited logging, like they have like proprietary, like firmware, like all these different things that are happening on the back end there. They can't easily run like EDR or other security things. So it's just like it makes it hard, really hard to secure them.

But then on the other and on the other side of the coin, like they're these vulnerabilities make them wide open for threat actors, you know? Yeah, you, that was a great point. You, when we were talking about this yesterday, you were like, you know, these things don't have the kind of telemetry and EDR on them that, you know, an endpoint device would. So you don't really have the visibility all the time of what's going on on them. And I think that's important. And also the fact that, like you said, they're a lot of them are running on some proprietary Linux fork that like 3 guys wrote in 2001.

And those guys, you know, retired to West Palm Beach a long time ago. And, you know, trying to maintain that software or figure out what the Hell's going on in that code base is a really difficult task. You know, I know people that have worked on product security in those on, you know, in these organizations and they'll look at this spaghetti code and they're just like, I don't know which 27 people wrote this, but I, it doesn't make any sense to me and I don't know how any of it works.

Right. You know, it's just a it's just a mess, yeah. It is, and it's, it's rare. Weirdly, when we see one of these vulnerabilities that's not already exploited when the advisory comes out, you know, both of the ones we're talking about are actively exploited right now. The Avanti one, there are updates for that are available. The Palo Alto one there are not, and they're not coming out until later this month. I think the earliest ones are on either the 13th or 15th of May.

And then the next one is I think May 28th. So that's a pretty large window of exposure for these known vulnerabilities that are being exploited. There are thousands of these devices out there and attackers have a lot of experience going after them because there's they've been doing it for several years now. Because there's so many of these bugs, they know how to do it. Yeah, Yeah, I know For Avanti, I just saw some news this morning that CISA has added it to its known exploited vulnerabilities catalog and it's being federal agencies just a couple of days to try to add the the patches, I think 4 days it said so.

So they're they're moving quick on that to try to get those patched up. That it's normally like for people that don't like spend their days reading the Sis and Kev like we do, that's like that's a short, that's a short window in relative terms. A lot of times it's 30 days or something like that. But it I don't know if this one says that, I haven't read that entry, but a lot of times it'll say if you can't patch, literally unplug that device and take it off the Internet. Yeah. Which is tough for a firewall or a VPN concentrator or you know, something like that that these organizations depend on.

So I don't know, like you can't just RIP and replace firewalls very easily. No, yeah, they're pretty. They're they're embedded pretty deeply. And if if you do RIP and replace them, there's a good chance that the one you put in there probably has some known exploited vulnerabilities in. It too, that is true, yeah. It's a, you know, game of chance. It's rolling the dice, everybody. But it was funny when I was, it was writing up about the Avanti vulnerability. So there were one thing that they said was they said that there were two vulnerabilities that I know actually you wrote about in January.

Do you remember that and those ones? I was going back and reading about those ones and it was, it was interesting because in their advisory they said, let me just double check here, They said if if customers followed Avanti's recommendation in January to rotate credentials, if you were exploited with these two bugs, so CBE 20261281 and CBE 20261340, your risk of exploitation from this more recent vulnerability is significantly reduced.

But. Not 0. But not zero. Yeah, but I I was like, huh, What an interesting statement to make. It's weird that came up in. Actually it's a good segue. That Linux bug that I wrote about yesterday, I, I, I really don't want to say the name of it, but it's called Dirty Frag and I hate it so much. I'm sorry, but like. Googling. I know I did it in like a DuckDuckGo tab on my phone 'cause I didn't want to.

Like, it's so bad. You guys got to get better at this. I understand. Like there's actually an explanation for why it's called that, but whatever. Yeah. And it does have a logo, which is just a a Penguin throwing a hand grenade, which like, I mean, I guess sure. It's pretty. Pretty innocent. Yeah, I was not going to use that for the image for the story. I'm just, I don't want hand grenades. But anyway, the researcher who discovered that bug directly can connected it to the copy fail bug from a couple weeks ago and said copy fail inspired him to go and look at at these other areas.

And that's how he found this vulnerability or he calls it a bug class. And it's again a kind of a universal Linux local privilege escalation vulnerability to effects a bunch of different Linux distros. And he said in the his advisory that if you had put in place the mitigation, that mitigations that were recommended for copy fail. It reduced the risk of this one, but it doesn't eliminate it. Eliminate it.

Good Lord. So it's kind of the same thing. But again, like these local LPE bugs, you know, if somebody is exploiting this on your box, a bunch of things have already gone wrong. I think I said this last week or two weeks ago. But it, you know, it holds true. And there are so many local LPE vulnerabilities in both Linux and Windows that when new ones come out like this, it's cool. I mean, it's great work. Like I'm always impressed when people do this kind of stuff. But it's not one of those like unplug your laptop and throw it in the ocean type moments because there, there are dozens of these things already out there, you know, that are, yeah, usable anytime an attacker wants. Yeah, I know.

And so I know. And that's a good point to make, by the way. Like I think it, I mean, this is definitely not good. But like you would, if you're already, you know, at the point where you could exploit this, like there are so many other bad things that could happen. But so when you wrote this, like what, what were some of the differences between copy fail and this bug? Like what were some of the mean? This one is a combination of two separate bugs actually he chained together to I guess existing bug classes and kind of turn them into this new like Reese's Peanut Buttercup of vulnerabilities.

But and it seems to affect a different set of Linux distributions too. It's not the same. It's not the same group of Linux distros, but it seems to be just as easily exploitable as copy fail. So you know, it's kind of right, right there in the same, the same area. But again, I do think that because now all of a sudden we've seen a few of those, we might see more of them because that's just the way that bug hunting works. You know, people when people are looking for a new idea or a new area to focus on, they kind of, you know, just as everybody does, you look at what other people are doing and you're like, oh, that looks interesting. I'll go look over there.

So, you know, I don't know if like 2 weeks from now we'll be talking about another one, hopefully with a less gross name. But you know, yeah, we need like a some kind of naming clearing house that approves or, you know, rejects bug names. It's like, I'm sorry, like we see what you're going for. But no, you're going to need to come back to us with something else, like a mood board, something. Give us some more, some more. Names, mood board of vulnerabilities.

Yeah, Yeah. That's so for for that vulnerability to what was or you know, set of vulnerabilities, it seemed like there was some sort of disclosure like, oh, is that that's another aspect of it. Yeah, that's how crazy this week is. I completely forgot about that. And this used to be one of those things that would cause all kinds of hell in the security community when somebody broke a bug embargo. You know, by nature, especially in the Linux community, because there's this Linux kernel mailing list where people will like, if you're, if you have insomnia and can't go to sleep, go read the Linux kernel mailing list. That'll fix that shit.

But you know, people will say we this bug is in the hopper, whatever, there'll be limited details. And obviously they're communicating with the maintainers of specific distributions and the Linux kernel maintainers themselves in the background, all that kind of stuff. Somebody and it's the details aren't clear, but they said a third party broke the embargo yesterday being May 7th and published exploit details online. And that's so by agreement, the researcher then went ahead and published his full advisory and exploit details and all that kind of stuff too.

And I haven't seen that happen in a while that kind of like explicit, somebody screwed or not screwed up, somebody did this intentionally. And so now we're going ahead and, you know, letting the cat out of the bag. It, it used to be like this, you know, God, there were so many stupid e-mail list arguments about that shit 15 years ago. But yeah, that's the kind of thing that like with a bug like this, it's not as big a deal as if it was, you know, some RCE in, say, firewall or something. But yeah, that it's never cool when people do that. Sometimes it happens by mistake, sometimes it's on purpose. I I don't know what the case was here, but. Yeah, just a level of coordination that goes into that because from the vendors, well like you know under normal circumstances, like the vendors want to prepare themselves as well, right, getting every, getting everyone else rallied and.

They want the upstream patch to be in place. Yeah, right. Sometimes they'll even like be working with like depending on how many different like users or levels of users are, are working on the version. Like they'll even work with customer customers privately to try to get the patches down to them. And then it's more widespread, like if there's like, I don't know, some, some like different levels, I guess.

I think that's usually what happens. But yeah, so anyways, it's it's pretty complicated. Yeah, and you know, again, thankfully this is just a local LP. It's not the end of the world type thing, but it's, you know, it's an interesting one that I I really dislike that name, but that's whatever. You. Know it's where we are. I don't think we really have any good news to end the podcast with again this week, but you know what we could do there?

Was a there was an arrest. We could. Oh, Karakurt. Somehow the arrests have turned into our good news on this podcast. Yeah, the Karakurt ransomware thing that you pointed me to, it seems like 100 years ago, but I think was yesterday. Let's see, that one was. I think when you sent it to me, it was yesterday the. The what? Well, so I I pointed you to two different ones.

There was one about this guy who like got OK yeah no I'm mixing them up. The one I'm talking about is Oh my gosh the news has been insane this week the the Care Kurt ransomware guy got sentenced to 8 years in. Two different things. The one that I also pointed you to yesterday was some guy got arrested for his role in like a crypto heist. So.

Crypto heist is like underselling what these these guys were doing. Let me see if I can bring it up real quick. Our chat history is so long from yesterday. I can't even like see if I can find that link, but the I don't I don't know if this group had a name or whatever it was, but he was 20 years old. I can't recall his name, but part of some like Crypto Heist.

I don't know that they were doing ransomware stuff. It didn't seem like it, but it was more like cryptocurrency extortion and that sort of, you know, shenanigans going on. Oh, yeah, here's the link. God, dude, his his handle was goth Ferrari. All right, man. Yeah, 20 years old, sentenced to 78 months in prison for the sprawling social engineering conspiracy that stole well over $250 million in cryptocurrency. Go it.

We'll put the link in the show notes. Like, we can't even read through all the nonsense that these people are up to. But they had, like, there was one thing that caught our eye when we were looking at. They had a nightclub bill that was like $500,000 or something like that. Per evening. Per evening. OK, here it is, here it is. Members and associates of the social engineering enterprise use stolen virtual currency to purchase, among other things, nightclub services ranging up to $500,000 per evening luxury handbags valued in the 10s of thousands of dollars, which were given away at nightclub parties. I didn't even notice that.

Lindsay, have you ever been to a nightclub party where they gave away like Birkin bags? No, I don't. I mean, I don't think it's worth it to be partying with these people, but but maybe. That party sounds like my worst nightmare. Like a bunch of over stimulated crypto Bros just giving away luxury goods is oh God. It's like the setup for Beekeeper 2 or something like that. It sounds like an absolute nightmare scenario. But they had all the other, like, gross stuff you would imagine, like luxury watches valued up to $500,000, luxury clothes, cars, rental homes in LA, the Hamptons in Miami, the literally the triumvirate of, you know, cliche vacation spots for nouveau riche jerks.

And I just can't. There was, and there's a screenshot in this press release of this guy, I guess on a video on a security camera. He had just thrown a rock or a brick through somebody's window to go in and steal a hardware crypto wallet. Yes. I have a lot of questions about this, but one, the main question is if you're this sophisticated social engineering ring and now you're just throwing rocks through windows like a 14 year old on Halloween, And also what are you doing with a hardware crypto wallet without the key to open it?

I don't understand how that's working unless they had some somebody or some way to open these things. But as far as I know, there's no universal way to open a hardware crypto wallet. Like you need the key, you need the password. So I don't know, but it doesn't seem like they were short on funds. Seemed to be working. Yeah. It looks like they at some level it says they did had these like fraud schemes to like manipulate victims into surrendering access to the digital wallets. But the hardware wallets, that's where it gets me. I, I don't understand that because like, I don't know, there, I have so many questions.

People should go and look at this press release. Like if you need some Comic Relief today, go and look at it because the screenshots are amazing. There's a picture of one of these Hermes bags with just like a cat looking at it. Yes, for some reason, like the cat is looking at it. Like what are you doing, man? The cats, like I've seen things I don't want to talk about. Then there's some pictures of some guns. Of course of. Course. Because that's what you know, again, over stimulated like teenagers would go and buy, but God, what are we doing?

It's unreal that the nightclub bills are insane to me. We were talking about this even in let's say Miami or Las Vegas. Do you know how hard you have to try to spend $500,000 in six hours at a nightclub? Or even if you rent out the entire club and pay for everyone's? I don't know like but. I'm I'm honestly impressed.

It's, I mean, that's incredible work by them. But. I just, again, insane, absolutely insane what people are getting up to these days. I mean, I know Jesus. This I, I'm, I think we should like buy the rights right now for making this film. For real? Yeah. And we can just call it Dirty Frag. It'll be great. Yeah, Oh my gosh. Enough. Yeah, enough.

Some other Comic Relief. And this has nothing to do with security, but we were talking about content management systems last week, I think with the the C panel thing. And then over the weekend, last weekend, my wife convinced me to go see The Devil Wears Prada too, which was very funny. I enjoyed it. I'm not going to lie beside love Anne Hathaway and Meryl Streep and whatever is very funny.

One of the things that happens in this movie, and this is very like niche, niche, whatever stuff is Anne Hathaway's character, Andy Sachs becomes the feature editor at the AT Runway magazine, that fictitious magazine in these movies, and she's trying to revive their features department. And so she's going out and doing feature stories on her own. And we see two times in this movie this woman typing her story directly into the content management system, just on location, like at a press conference, typing her story into the CMS and hitting publish like an absolute sociopath.

And there's another scene where she publishes from her phone. I think she's on the train or something sitting in the theater. Like I audibly I was like my wife was like what? What Like I explained it later, she's like, who cares? But like I texted you later, I was like, you will not believe this. And then for whatever, I posted some dumb tweet about it somehow, like some large accounts, like a White House correspondent for Cbsi think some New York Times reporter saw it somehow and like reposted it. And over the weekend, there were like hundreds of thousands of views of this thing.

And the replies were I unhinged in like some very funny ones. And then other people were were like, I do this all day, every day. Yeah. Which I do think it's a very clear like age generation dividing line, I think. And you must be just on the other side of it, like, or you're just more careful than these maniacs are. That's what I I think it's less about age and more about how much of A risk taker you are and how much anxiety you have like. Yes your response was my anxiety would never let me do that. I, I definitely did it, you know, in my threat post days, we did it.

I used to do it like at conferences and things like that. When you were sitting, let's say, a Black Hat or sass and somebody was doing a presentation on some like, very cool research that you knew was going to be a big deal. And I knew that, like Bob McMillan and a bunch of other reporters were sitting in the same room as me. And I was like, OK, let's get this up as quickly as possible. That also bit me in the ass many times because the CMS would just crap the bed and your story was gone. This is before autosave, everybody. So it would just like disappear.

It would be gone. And like, I have very clear memories of that happening to me in remote locations. You're like, well, that story just doesn't exist anymore. You have your canvas moment. Literally, yeah, yes, yeah. And so clearly the people that are like, oh, I just do that all the time in WordPress. I'm like, OK, WordPress is stable. You can do that. That's true. We had Drupal. You guys don't even know Drupal. Drupal, yeah.

That thing was not stable. It would literally fall over daily. So no, the the PTSD does not allow me to type directly into our CMS. Get out of here with that. Drupal. That's why I have anxiety, yeah. Yeah, that, and I mean, some of the responses, the replies to this tweet are just so funny. There was one that you pointed me to that I hadn't seen. It was like, God forbid a woman, what was it?

I, I can't remember what it was. God forbid a woman do her job her own way or something like that. It's so good. There were some other funny ones. I need to pull it up. I'm like. I was scrolling through. They were just unreal. Like some people were legitimately like, how could you possibly do this? Somebody said that like day one of J school, they told them like a keep your notes and B never filed directly in the CMS. OK, that's I appreciate them teaching that in school now, but. That's so I know.

It's great advice. A lot of different variety of replies here. Class Twitter like it's just people stirring the pot. Like some people are like, why? Like and like. Why is this a big deal? Right. Those people, I don't know who they are, but they're, I was very like, surprised and encouraged by the lack of like mean replies. Yeah, yeah. I couldn't believe that. Like I kept waiting for those to show up in, I don't know, maybe I'd they're like blocked or muted ones that I never saw.

But it was just, it was very entertaining on like a Sunday afternoon, seeing as like I kept laughing. It was wildly entertaining. That's so great. God forbid a woman to her job. Her way. That's so funny. That's the point I was making. Classic. Yeah, so that's the Comic Relief for everyone for. This week, yeah, go go check out Dennis's viral tweet. That was the other thing that like occurred to me like that is so like that is a very minor level of virality these days. I can't imagine if you're someone who's, you know, tweet or Instagram post or something like that get all of a sudden gets like 5 million, you know, likes or replies or tweets or, you know, or or repost or something. How do you even you know, Because you know, the 99% of those are going to be just mean

no matter what your thing was like, it's just going to be like venom. Yeah, that's when you just. You just gotta. Throw the phone in the ocean. Mute and throw your phone in the ocean, yeah? Yeah, which is good advice anyway, obviously. Yeah. But all right, well, that was a hell of a week. I'm really tired. Yeah, I I'm hoping things will die down for the weekend, but who knows? I really hope so 'cause I have lots of yard work to do, so yeah, yeah. Me too. All right, Lance, good to see you have a great. Weekend.

Thank you. See ya. Bye. While you were happy with planning, I was trying to decide what in land. Even if I couldn't. Understand it.