A network security breach can be devastating for both an organization’s reputation and its finances.
The implications of a breach could affect millions – not just the victim itself, but their customers or clients, too.
The Daily Swig aims to keep on top of the latest network security attacks and network security latest news.
Keep up to date with recent network security news and network security breach news here.
1. Cisco ClamAV anti-malware scanner vulnerable to serious security flaw
John Leyden 22 February 2023 at 14:23 UTC
Vulnerabilities Network Security Cloud Security
Patch released for bug that poses a critical risk to vulnerable technologies
A security flaw in a bundle anti-malware scanner product has created a serious security risk for some products from networking giant Cisco.
More particularly, a vulnerability in the ClamAV scanning library (tracked as CVE-2023-20032) created a critical security risk for Cisco’s Secure Web Appliance as well as various versions of Cisco Secure Endpoint (including Windows, MacOS, Linux, and cloud).
Cisco released an advisory on the vulnerability – alongside patches for affected products – last week. Although the vulnerability is not under active attack, patching is nonetheless recommended.
The partition scanning buffer overflow vulnerability poses a critical risk to vulnerable technologies.
Catch up with the latest network security news and analysis
As explained in Cisco’s security advisory, a vulnerability in the HFS+ partition file parser of ClamAV creates a mechanism to push malicious code onto either endpoint devices or vulnerable instances of Cisco’s Secure Web Appliance.
The vulnerability, which stems from an absent buffer size check, creates a heap buffer overflow risk in scanning HFS+ partition file. An attacker might be able to create a malicious partition file before offering it up for scanning by ClamAV.
“A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition,” Cisco’s advisory explains.
Use case
ClamAV (Clam AntiVirus) is a free software, anti-malware toolkit originally developed for Unix. The technology – acquired by Cisco through an acquisition 10 years ago, has been ported to run on various operating systems including Linux, macOS, and Windows.
One of the main use cases for the technology is on mail servers as a server-side malware-in-email scanner.
However, Cisco has confirmed that neither its Secure Email Gateway nor its Secure Email and Web Manager appliances are vulnerable to this particular security bug.
Who guards the guards?
Any vulnerability in a security utility that allows potential miscreants to hack into affected devices show how tools designed to increase security can increase the attack surface exposed to potential attackers.
The security flaw in ClamAV’s HFS+ partition file parser, along with lesser a remote information leak vulnerability (tracked as CVE-2023-20052) in the DMG file parser of the same technology, were both discovered by Google engineer Simon Scannell. Google notified Cisco about security bugs in ClamAV last August.
An advisory by Google, posted on GitHub, offers a full technical run-down of the more serious CVE-2023-20032 vulnerability and its potential exploitation.
“We rate the vulnerability as high severity as the buffer overflow can be triggered when a scan is run with CL_SCAN_ARCHIVE enabled, which is enabled by default in most configurations.
“This feature is typically used to scan incoming emails on the backend of mail servers. As such, a remote, external, unauthenticated attacker can trigger this vulnerability,” Cisco’s advisory explains.
A technical blog post by German cybersecurity vendor ONEKEY concludes that the two flaws in ClamAV illustrate that “file format parsing is a difficult and complex endeavor”.
Password manager security: Which is the right option for me?
Ben Dickson 14 February 2023 at 15:58 UTC
Updated: 15 February 2023 at 11:40 UTC
Passwords Authentication Data Breach
The first guide of our two-part series helps consumers choose the best way to manage their login credentials
While we continue to wait for the long-awaited password-less future to arrive, individuals and enterprises are still stuck with the problem of how to manage their countless, proliferating login credentials.
Whether they allow browsers to save passwords, rely on Apple’s Keychain or another operating system utility, or trust a dedicated app, most people and organizations now use some form of password management utility.
A password manager creates an encrypted vault that securely stores credentials. These are protected by a master password.
Read more of the latest security news about passwords
Most consumer-focused apps can also create unique, random passwords and support safe credential sharing between friends and family members.
Some also contain extra perks such as detecting reused passwords and monitoring your accounts for possible data breaches.
Given the differences in functionality and pricing tiers, The Daily Swig is offering a comparative, two-part guide to some of the most popular password management utilities available for consumers and businesses.
This article, part one of our series, looks at consumer password manager options, while part two will showcase some of the best choices for enterprises. Stay tuned for the forthcoming second guide.
1Password
1Password offers an easy sign-up process and printable digital key for recovering your account in case you forget your master password.
The application has apps for macOS, Windows, Linux, Android, and iOS as well as a Chrome extension that enables a user to auto-fill login information on websites and store new credentials in their vault.
The tool allows you to create multiple vaults to organize your data for various purposes (personal, work, etc). In addition to login information, you can use 1Password to store credit card information, API tokens, crypto wallet recovery seeds, and other sensitive documents or data.
The password manager also allows you share to passwords with other users. You can tweak the sharing feature by setting expiry dates, maximum number of views, and specific email addresses that can access a password.
1Password’s Watchtower feature monitors your account for reused passwords, vulnerable passwords, and potentially compromised accounts.
The application also has a Travel Mode for special circumstances where your devices might fall into unwanted hands. Vaults that you mark as not safe for travel will disappear from your devices when you turn on Travel Mode and reappear when you turn the feature and re-connecvt to the internet.
The password manager offers no free-of-charge plan and instead offers personal ($2.99 per month) and family ($4.99 per month) subscriptions. With the family subscription, you get five premium accounts and the ability to create shared vaults that you can use together.
- Pros: Flexible password sharing, Watchtower feature for monitoring password reuse and website breaches, strong MFA (multi-factor authentication) support
- Cons: No free plan, limited import options
1password offers a password vault that offers a more convenient way to manage login credentials
Bitwarden
Bitwarden offers a full range of standard features including the ability to import data from other password managers, creating multiple vaults, sharing passwords with other users, and syncing vaults across multiple devices. It has apps for all major operating systems, extensions for nine different browsers, and a command-line interface for writing scripts.
One feature that sets Bitwarden apart is its strong free-tier option, which provides features that most users typically need. The premium subscription ($10 per year) also adds security reports, stronger 2FA (two-factor authentication) options, 1GB of encrypted storage, a OTP (one-time password) generator, and emergency access to your vault by other (nominated) Bitwarden users.
Bitwarden also has a family plan ($40 per year) with six accounts, shared password collections, and shared encrypted storage.
Bitwarden is an open source program, which means you can host it on your own servers if company or industry regulations prevent you from storing your credentials in the public cloud. However, to get the full range of features, you’ll need to purchase a premium license.
- Pros: Strong free plan, competitive price for premium and family plans, open source, self-hosting support, strong MFA support, command line interface
- Cons: Limited storage, limited MFA on free plan
Dashlane
Dashlane is another online password manager that provides basic features to store and secure your passwords, including creating vaults, generating passwords, filling online forms, and importing data from other managers.
The tool provides a very limited free plan that only works on one device. The advanced tier ($2.75 per month) removes the device limit and adds a service that monitors the dark web for breached passwords and compromised accounts.
The premium plan ($4.99 per month) adds VPN support, and the family plan ($7.49 per month) provides 10 premium accounts plus a dashboard to manage accounts and shared resources.
Unlike other password managers, Dashlane doesn’t have a desktop application – PC users must do everything through the web portal and browser extensions. But it does have mobile apps for Android and iOS.
Dashlane allows you to share passwords with other Dashlane users and set limits to what kind of access they will have to your credentials.
Dashlane’s emergency access feature also allows you to specify a contact who can assume ownership of your account in case you lose access, and you can specify a waiting period to accept or reject the user’s request to access your vault.
- Pros: Password history, VPN support, dark web monitoring, no desktop application, strong emergency access options
- Cons: Free plan limited to one device, expensive premium plan
- Pros: Passwordless login support, dark web monitoring, password strength report
- Cons: History of poor security practices, limited free plan
READ Bitwarden responds to encryption design flaw criticism
KeePass
For users who don’t trust online services with their passwords – a legitimate concern after the LastPass debacle – KeePass is a convenient alternative.
KeePass is a standalone application that provides many of the functions you would expect from a professional password manager, but with some notable exceptions. Absent features include the ability to auto-capture new passwords, syncing across multiple devices, password sharing, and scanning the web for breached accounts.
KeePass also fails to offer a web interface, browser extensions, or support for multiple platforms. The package comes as a Windows application, although being an open-source project means developers have ported it to other platforms. You’ll find links to these software packages on the KeePass website.
In KeePass, you can create password databases to store passwords, notes, and documents. These password databases can be copied to other devices, but you’ll have to sync them manually.
KeePass lacks support for many types of data, such as credit card info and API tokens, by default, but you can customize the utility to support different data types. Instead of autofill, KeePass has an auto-type feature that emulates typing your credentials on the keyboard, a feature than can require a bit of getting used to.
While this is not the most convenient password manager, it is a decent option for advanced users who want full control of their data and the ability to tinker with the software.
- Pros: Free, open source, full control of your data, highly customizable
- Cons: No automatic password capture, inconvenient auto-fill feature, clunky multi-platform support
Operating system password managers
Alternatively, you can use a tool that comes bundled with your operating system. Most popular among them is Apple’s Keychain, which encrypts and stores your passwords in a secure vault on your device.
The main advantage of Keychain is its deep integration with the Apple ecosystem. It automatically detects and fills passwords for websites, applications, WiFi networks, and more. It can also be synced to your iCloud account and made available across all your Apple devices, including Mac, iPhone, iPad, and Apple Watch.
So Keychain is convenient if you only use Apple devices. But if you have other operating systems in the mix (Android, Windows, Linux), then you’ll need a separate password manager. You also won’t be able to use it if you want to log into one of your accounts from a friend’s device or a public computer.
