This Week in Security: Microsoft on Microsoft, Register Your Domains, Linux on ARM, and FreeBSD Joins the File Cache Club

Microsoft has addressed a critical bug in GitHub that could allow attackers to steal user authentication tokens via the embedded web-based VSCode editor. The fix was announced after security researcher Ammar Askar detailed the vulnerability, which could have enabled malicious extensions to exfiltrate tokens, posing a significant security risk for developers and organizations relying on GitHub.

In a detailed blog post, Ammar Askar explained that the bug allowed malicious actors to manipulate the sandboxed environment of GitHub’s embedded VSCode to install extensions that could extract user tokens. Microsoft confirmed that the issue has been patched, and urged users to update their environments to mitigate potential exploitation.

Meanwhile, a separate incident involved GitHub repositories related to Microsoft’s Azure cloud platform being automatically disabled after a supply chain attack involving the Miasma worm compromised the Microsoft Durabletask package. Over 70 repositories, including those critical for Azure operations, were flagged and taken offline within minutes by GitHub’s automated security systems. The infected package, previously compromised in May, had over 400,000 downloads per month, raising concerns about widespread impact.

In other news, researchers uncovered unregistered domain names referenced in TP-Link firmware, which devices checked in with over years. A researcher named Julian B registered one such domain, which was previously used by TP-Link devices for communication, and reported the issue to the company. The security implications of this unregistered domain remain unclear, but it highlights potential risks in device firmware security.

Additionally, OpenSSL revealed a set of new vulnerabilities, including a high-severity use-after-free flaw in PKCS7 handling that could allow attackers to execute arbitrary code. The vulnerabilities mainly affect applications processing PKCS7 or S/MIME messages, but most web servers are unlikely to be impacted. Users are advised to update OpenSSL promptly.

Finally, the researcher known as NightmareEclipse, now operating as MSNightmare, returned with new exploits targeting Windows Defender and BitLocker, despite Microsoft’s earlier threats of legal action. The exploits include RoguePlanet, which exploits race conditions to gain system-level access, and GreatXML, a BitLocker bypass that works if an offline scan has been performed. These discoveries come amid ongoing tensions between researchers and Microsoft over vulnerability disclosure.

Why These Security Updates and Incidents Matter

The week’s developments underscore the ongoing risks associated with supply chain attacks, open source vulnerabilities, and device firmware security. Microsoft’s quick response to the GitHub token leak demonstrates the importance of rapid patching, while the discovery of unregistered domains in IoT firmware highlights persistent device security challenges. The return of a controversial researcher and new Windows vulnerabilities reveal tensions in vulnerability disclosure and the need for robust security practices across platforms.

These incidents affect developers, organizations, and consumers by exposing potential entry points for attackers and emphasizing the importance of timely updates, secure coding practices, and careful device management. The accumulation of such risks underscores the necessity for ongoing vigilance and improved security protocols across the tech ecosystem.

Recent Trends in Supply Chain Security and Vulnerability Disclosure

Supply chain attacks continue to be a major concern, with recent incidents involving Microsoft’s open source repositories and the compromise of the Microsoft Durabletask package. The attack on GitHub repositories illustrates how automated security systems can quickly contain outbreaks but also cause operational disruptions.

Simultaneously, the security community remains active in discovering and reporting vulnerabilities, as seen with the OpenSSL flaws and Windows exploits. The controversy surrounding the return of researcher NightmareEclipse reflects ongoing debates about vulnerability disclosure norms, legal boundaries, and the evolving relationship between security researchers and corporate entities.

Overall, these events highlight the persistent challenges in maintaining secure software supply chains, the importance of timely patching, and the complex dynamics of vulnerability research and disclosure.

“The GitHub bug allowed malicious extensions to exfiltrate user tokens via the embedded VSCode environment. It’s now fixed, but users must update immediately.”

— Ammar Askar

Unresolved Questions About Ongoing Security Risks

It is not yet clear whether the unregistered domain in TP-Link firmware was actively exploited or posed a significant security threat. The full extent of the impact from the Microsoft supply chain attack remains uncertain, particularly regarding whether other repositories or services are compromised. Additionally, the long-term effects of the newly disclosed OpenSSL vulnerabilities depend on whether affected applications are widely used in critical infrastructure. The implications of the return of NightmareEclipse and the potential for further exploits are still developing, with no official statements on the scope or scale of the threats.

Next Steps for Security Patching and Research

Organizations should prioritize updating affected software, including OpenSSL and any impacted repositories on GitHub. Users of TP-Link devices should monitor firmware updates and security advisories. Security researchers expect continued disclosures and possibly more exploits from MSNightmare, prompting Microsoft and other vendors to strengthen vulnerability management. Additionally, the security community will likely scrutinize the impact of the recent supply chain incidents to improve detection and response strategies. Ongoing collaboration between researchers and vendors remains essential to mitigate emerging threats.

Key Questions

What should users do after the GitHub token vulnerability fix?

Users should update their GitHub environments, especially the embedded VSCode, to ensure they have the latest security patches and prevent potential token theft.

Are TP-Link devices at risk from the unregistered domain issue?

The risk remains unclear; however, users should follow official firmware updates and security advisories from TP-Link to mitigate potential vulnerabilities.

How serious are the OpenSSL vulnerabilities?

The vulnerabilities range from low to high severity; users should update OpenSSL to the latest version as soon as possible to protect affected applications.

Will Microsoft address the exploits released by MSNightmare?

Microsoft is expected to release patches during upcoming Patch Tuesday cycles, but users should be cautious and monitor security advisories for immediate mitigations.

What does this week’s security activity indicate about future threats?

The ongoing incidents suggest that supply chain attacks, firmware vulnerabilities, and researcher-company tensions will continue to be major themes in cybersecurity, requiring constant vigilance and proactive defense measures.

Source: Hackaday