JSOF Cyber Security

JSOF is a boutique cyber consultancy and project firm. We are cyber security experts

[JSOF Cyber Security @JSOF18]

We are releasing Dnspooq - 7 vulnerabilities in dnsmasq, and open source DNS forwarder used in major Linux distributions and by dozens of vendors
https://t.co/IGUcbozn3A

[Mathy Vanhoef @vanhoefm]

I found some design and implementation flaws in Wi-Fi again. All Wi-Fi devices are affected. It was a long ~9 months embargo, over this time a lot of info has been collected and that info now available at https://t.co/nAQtK9XY0R

[Forescout @Forescout]

Forescout & @JSOF18 research disclose NAME:WRECK - 9 new DNS #vulnerabilities affecting popular TCP/IP stacks used in millions of #IoT #OT & IT devices. https://t.co/gHdtXLA5qj

#NAMEWRECK

[JSOF Cyber Security @JSOF18]

@campuscodi Attackers can't use vulnerabilities if your systems simply don't work. Good security engineering by the government!

[samvartaka @s4mvartaka]

As part of Project Memoria we're releasing a report together with @JSOF18 on several DNS vulnerabilities in popular TCP/IP stacks (FreeBSD, NetX, Nucleus NET, ...), including a breakdown of underlying anti-patterns (hint: check your message compression).
https://t.co/6rn5M9N8sl

[JSOF Cyber Security @JSOF18]

Announcing the latest research by @JSOF18 and @Forescout
Great coverage by @campuscodi as always.

#NameWreck #IoT #Cyber

[Sussex Lass @bexleyt]

Forescout and JSOF Disclose New DNS Vulnerabilities, Impacting Millions of Enterprise and Consumer Devices - Forescout https://t.co/G6c1DBJv1O

[JSOF Cyber Security @JSOF18]

@bexleyt Great working with you and @Forescout !

[JSOF Cyber Security @JSOF18]

@brakesec Thanks for sharing!

[Halvar Flake @halvarflake]

Were there just 3 RCEs in ipv4 ipv6 and DNS on windows?

[Qualys @qualys]

The Qualys Research Team has discovered a critical vulnerability in #Sudo, which allows an unprivileged user to gain root privileges in its default configuration. #linux #unix #vulnerability https://t.co/JUAo8ULMu7

[JSOF Cyber Security @JSOF18]

@knqyf263 We Love your writeup and poc. We are an independent consulting and research company based in Israel, and are not related to the NXNS attack.

[JSOF Cyber Security @JSOF18]

@blackorbird Looks like the PoC was written by @knqyf263. Nicely done!

[JSOF Cyber Security @JSOF18]

@blackorbird Nice PoC! We’re glad our whitepaper is detailed enough to help in get out an independent PoC so fast.

[JSOF Cyber Security @JSOF18]

The #Dnspooq graphic design award goes to @BleepinComputer !

P.S. upgrade your dnsmasq to version 2.83 or above

[BleepingComputer @BleepinComputer]

DNSpooq bugs let attackers hijack DNS on millions of devices - @serghei
https://t.co/dNyRLgCCZn

[JSOF Cyber Security @JSOF18]

@eqhmcow @vijaycert @ICSCERT @certcc It was part of a different research project actually, not a specific target selection. The results of the original project will be published sometime soon. As separate a rule of thumb - clients tend to be less audited than servers, not always justified.

[JSOF Cyber Security @JSOF18]

Thank you @vijaycert and @ICSCERT @certcc for orchestrating the disclosure of @dnspooq!

[Vijay Sarvepalli @vijaycert]

Shout out to multiple vendors @cisco @google @The_Pi_Hole @RedHat to resolve @dnsmasq vulnerabilities. Thanks to @GitHubSecurity for GHSA platform and to @JSOF18 for responsible vulnerability disclosure!

[JSOF Cyber Security @JSOF18]

Supply chain issues affect Open Source Software too. Dnsmasq is extremely popular (and for a good reason!) and so the vulnerabilities affect dozens of vendors and many major Linux distributions.

[NULLCON @nullcon]

Researchers have found set of flaws allowing for DNS cache-poisoning attacks (also known as DNS spoofing)

DNSpooq is a series of vulnerabilities found in the ubiquitous open-source software dnsmasq, demonstrating that DNS is still insecure

➡️https://t.co/0WXVPhKk9M

#DNSpooq

[JSOF Cyber Security @JSOF18]

Some recommended workarounds for #dnspooq if you can't upgrade your device. Configuring your devices to directly query a trusted DNS server would also be helpful.

[BleepingComputer @BleepinComputer]

@serghei JSOF advises updating the Dnsmasq software to the latest version (2.83 or later) to fully mitigate DNSpooq attacks.

A list of (partial) workarounds is also available:

[JSOF Cyber Security @JSOF18]

@maddiestone So, In context of found in-the-wild exploitation the term probably applies to any actor as you defined. It is also used otherwise for how attackers might use N-days and be no less sophisticated.

[JSOF Cyber Security @JSOF18]

@maddiestone That is very impressive and interesting. There are also thousands of vulns reported yearly(many low-value ofc). Clearly those 24 are attributed to “sophisticated attackers”, at the same time, they can also do more than others with all the other vulns if/when not patched.

[JSOF Cyber Security @JSOF18]

@maddiestone As in “a sophisticated attacker could use this vulnerability like that” is probably a more common phrase than “a sophisticated attacker can find &exploit a chain of vulnerabilities in this product”

[JSOF Cyber Security @JSOF18]

@maddiestone Is the term “sophisticated attacker” widely used when discussing 0-days? It’s often used when discussing recently disclosed 1-days. If an attacker uses a true 0-day then nobody knows or can talk about that specific vuln (except for google TAG:)