The Hackle Box | December 2023: Breachmas & Common Social Engineering Attacks

### Overview In this holiday edition of The Hackle Box ("Breachmas"), hosts Pinky, Eric, and their co-host discuss the seasonal surge in cyberattacks and social engineering campaigns. The discussion explores why the holiday season creates fertile ground for social engineering, examines recent critical enterprise and networking vulnerabilities—including those affecting Atlassian software, Sierra Wireless cellular routers, and Cisco IOS XE devices—and outlines essential defensive strategies and operational security practices.

### Key Topics - **Seasonal Social Engineering & Psychology:** Threat actors exploit holiday stress, distracted employees, and shared experiences (such as year-end HR policy updates, benefits enrollment, shipping notices, fake purchase receipts, and fraudulent gift card offerings). Attackers frequently pair these lures with token theft or phone-based vishing to extract sensitive banking or authentication details. - **Token Theft & MFA Bypass:** Attackers increasingly deploy reverse-proxy style attacks (e.g., EvilProxy) targeting Microsoft 365 and Google accounts. By acting as an intermediary to the legitimate login interface, attackers capture active session tokens after multi-factor authentication (MFA) is completed. - **Incident Response Posture & Organizational Culture:** A single reported phishing email or compromised credential should trigger an organization-wide mailbox scan and threat hunt. Organizations must avoid shaming or penalizing employees who click on phishing links, fostering a culture where staff feel safe reporting mistakes early. - **Recurring Critical Vulnerabilities (Atlassian):** A recent batch of four critical remote code execution (RCE) vulnerabilities in on-premises Atlassian products highlights how high-profile flaws attract researcher and attacker scrutiny, often leading to rapid exploitation, drive-by ransomware, and backdoor persistence. - **Embedded & Unsupported Dependencies (Sierra Wireless):** Twenty-one flaws identified in Sierra Wireless AirLink cellular routers reveal the systemic risk of embedded, deprecated third-party code—specifically the unsupported TinyXML library—where device manufacturers struggle to supply fixes. - **Publicly Exposed Management Interfaces (Cisco IOS XE):** Two actively exploited vulnerabilities (a CVSS 10 privilege escalation and a CVSS 7.2 command injection) in Cisco IOS XE have resulted in tens of thousands of compromised devices monitored via Shadowserver sinkholes.

### Technical Details - **Evasion Tactics:** Attackers frequently hold newly acquired credentials in reserve, testing one account initially and using local or neighboring state VPNs/proxies to circumvent impossible travel alerting before deploying the remaining accounts. - **RCE & Persistence:** Recent on-premises Atlassian exploits frequently led to automated ransomware or the installation of persistent beacons within service account contexts, meaning patching alone is insufficient without dedicated threat hunting. - **Chained Cisco Exploits:** Threat actors abuse a CVSS 10 vulnerability in Cisco IOS XE to create unauthorized accounts, subsequently exploiting a 7.2 command injection flaw to escalate privileges and deploy malicious backdoors. - **Third-Party Dependency Vulnerabilities:** Firmware at the latest vendor release level may still incorporate insecure or deprecated software packages (such as TinyXML), posing hidden supply chain risks across critical infrastructure sectors.

### Takeaways - **Remove Admin Interfaces from the Public Internet:** Organizations must urgently pull management web UIs, internal Atlassian deployments, and remote management ports (such as RDP) off the public internet, requiring site-to-site or client VPN access. - **Scope Fishing Incidents Enterprise-Wide:** When investigating a phishing compromise, search all mailboxes for the malicious message, identify who read or interacted with it, and monitor for delayed credential reuse. - **Verify Out-of-Band:** Verify unexpected communications—whether executive file attachments, banking calls, or fraud alerts—via independently retrieved phone numbers or secure out-of-band channels rather than inbound numbers or links. - **Assume Compromise After Critical Flaws:** When public RCE bugs affect perimeter devices or services, assume persistence has been planted and actively hunt for indicators of compromise rather than relying strictly on software patching.