WithSecure™ Labs: With great research comes great responsibility

During a recent engagement, we came across an unfamiliar configuration pertaining to /var/lib/docker permissions. This, combined with a number of other lower risk issues, resulted in an attack path that allowed privilege escalation to root from a low-privileged user. As this configuration was non-standard rare to see, we thought we'd share our observations and methods for leveraging this particular weakness to the wider community.

This article demonstrates a practical approach to detect prompt injection attempts in LLM applications using a domain-specific dataset. We fine-tune a DistilBERT model to train a classifier that is able differentiate between legitimate inputs and potential injection attempts. 

In recent years, the use of internet-connected devices has become more prevalent in the healthcare sector, particularly as a means to communicate patient data. Therefore, it is essential that security testing is carried out against these devices to identify misconfigurations that could cause a severe impact, such as the prescription of incorrect drugs.

At DEFCON 2023 I presented some research in which I discussed an easier method of testing the Health Level Seven (HL7) medical protocol. This included a demonstration of a new tool I created named ‘HL7Magic’, which enables testers to proxy, parse and amend messages to demonstrate the impact of manipulating data sent to a medical device. This blog post has been released alongside the open-sourcing of this tool and will discuss the key concepts mentioned within my talk.

This blog post provides an overview of some common mainframe application vulnerabilities that we have observed during client engagements. It describes how these vulnerabilities often have unexpected implications. Then further highlights the importance of properly structured in-depth mainframe application security assessments.

This blog post aims to provide a starting point for anyone interested in mainframe binary exploitation. It discusses how low-level binary exploits and permissive controls on Authorized Program Facility (APF) libraries can be utilised for privilege escalation.

Since proof-of-concept code was released for two vulnerabilities in ConnectWise ScreenConnect, en-mass exploitation has started from multiple threat actors. Researchers in the security industry have reported on attack chains they have observed which include using ScreenConnect to deploy password stealers, other remote management software, and commercial post-exploitation frameworks. Some intrusions have even ended up with Ransomware deployments.