Elastic Security Labs discusses detection and mitigation strategies for vulnerabilities in the CUPS printing system, which allow unauthenticated attackers to exploit the system via IPP and mDNS, resulting in remote code execution (RCE) on UNIX-based systems such as Linux, macOS, BSDs, ChromeOS, and Solaris.

Update October 2, 2024

Key takeaways

The CUPS RCE at a glance

Elastic’s POC analysis

Executing the ‘Cupshax’ POC

Assessing impact

Remediations

Elastic protections

cupsd or foomatic-rip shell execution

Printer user (lp) shell execution

Network connection by CUPS foomatic-rip child

File creation by CUPS foomatic-rip child

Suspicious execution from foomatic-rip or cupsd parent

Elastic’s Attack Discovery

Conclusion

Key References

Cups Overflow: When your printer spills more than Ink

Wi-Fi cameras are popular due to their affordability and convenience but often have security vulnerabilities that can be exploited.

Introduction

AJCloud: A Brief Introduction

Initial Vulnerability Research Efforts

Initial Hardware Hacking

Wansview Cloud for Windows

Exploring the network communications

Advanced Hardware Hacking

Building a P2P Client

Impact

What did the vendors do right?

What did the vendors do wrong?

Mitigations

Key Takeaways

Storm on the Horizon: Inside the AJCloud IoT Ecosystem

Why DaC?

Improving Process Maturity

Bulk Import and Export of Custom Rules

Configurable Unit Tests, Validation, and Schemas

Custom Version Control

Broader Adoption of Automation

Lowering the Barrier to Entry

High Flexibility

In Practice

Establishing a DaC Baseline

Example

Development Space Rule Synchronization

Production Space Deployment

Now in beta: New Detection as Code capabilities

This article explains how we conduct comprehensive cyber threat data analysis using Google Cloud, from data extraction and preprocessing to trend analysis and presentation. It emphasizes the value of BigQuery, Python, and Google Sheets - showcasing how to refine and visualize data for insightful cybersecurity analysis.

Data extraction tools and techniques

BigQuery for data staging and querying

Colab Notebooks for loading staged datasets

Essential Python libraries for data analysis

Organizing Colab Notebooks before analysis

Extracting Our BigQuery datasets into dataframes

Embracing the art of data cleaning

Utilizing Pandas for data cleaning

Feature extraction and enrichment

Feature extraction

Data enrichment

Normalization

Anomaly detection: Refining the process of data analysis

Statistical methods – The backbone of analysis:

Aggregations and sorting – unraveling layers:

Visualization – The lens of clarity:

Machine learning – The advanced guard:

Beginning with a broad overview: Aggregation and sorting

The power of time: Time series analysis

Correlation analysis

Machine learning & anomaly detection

Behavioral patterns & endpoint data analysis

Selecting and aggregating key data points

Exporting reduced data to Google Sheets for accessibility

Pivot tables for in-depth analysis

Journey through Google's Cloud ecosystem

Modularity and flexibility in workflow

Orchestration and tool synchronization

Navigating the seas of cyber threat data with Google Cloud

Google Cloud for Cyber Data Analytics

ES|QL is Elastic's new piped query language. Taking full advantage of this new feature, Elastic Security Labs walks through how to run validation of ES|QL rules for the Detection Engine.

作者

Eric Forte

文章

Cups 溢出：当你的打印机溢出的不仅仅是墨水时

风暴在地平线上：AJCloud 物联网生态系统内部

现已推出 Beta 版：新的代码检测功能

用于网络数据分析的 Google Cloud

简化 ES|QL 查询和规则验证：与 GitHub CI 集成