Military maps released by Russia’s defence ministry on Thursday did not show Soledar under the control of Moscow’s regular army.

Recently patched Fortinet FortiOS SSL-VPN zero-day exploited in attacks against government organizations and government-related targets.

Fortinet researchers reported that threat actors exploited the recently patched FortiOS SSL-VPN vulnerability (CVE-2022-42475) in attacks against government organizations and government-related targets.

In December, the security vendor urged its customers to update their installs to address an actively exploited FortiOS SSL-VPN vulnerability, tracked as CVE-2022-42475, that could be exploited by an unauthenticated, remote attacker to execute arbitrary code on devices.

The security flaw (CVE-2022-42475) abused in these incidents is a heap-based buffer overflow weakness found in the FortiOS SSLVPNd that allowed unauthenticated attackers to crash targeted devices remotely or gain remote code execution.

The CVE-2022-42475 flaw is a heap-based buffer overflow issue that resides in FortiOS sslvpnd.

“A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.” reads the advisory published by the security vendor. “Fortinet is aware of an instance where this vulnerability was exploited in the wild,”

Fortinet addressed the issue with the release of FortiOS 7.2.3.

According to the experts, the threat actor behind the attacks is a sophisticated attacker due to the complexity of the exploit. The attackers exploited the flaw to deliver a variant of a generic Linux implant customized for FortiOS.

The malicious binary was located at /data/lib/libips.bak, attackers masquerade the malware as a component of Fortinet’s IPS Engine, located at /data/lib/libips.so.

“Libips.bak exports the functions ips_so_patch_urldb and ips_so_query_interface. These are the same exports in the clean IPS engine binary, libips.so. Both exported functions lead to the same malicious code. If libps.bak is named libips.so in the /data/lib directory, the malicious code will be executed automatically as components of FortiOS will call these exported functions.” reads the report published by Fortinet. “The binary does not attempt to return to the clean IPS engine code, so IPS functionality is also compromised.”

Post-incident meta data investigation allowed the experts to uncover an additional IoC, the IP address 185[.]174[.]136[.]20. A folder on the server was containing binaries built specifically to target FortiGate hardware versions.

Then the researchers created a set of Yara rules to hunt for similar file samples and identified the /var/w samples. The execution of these files was observed in the PCAPs but not obtained directly from the file system.

The analysis of the /var/w files samples revealed that threat actors use advanced capabilities to manipulate FortiOS logging, such as:

• The malware patches the logging processesof FortiOS to manipulate logs to evade detection. – /bin/miglogd & /bin/syslogd
• It includes offsets and opcodes for 27 FortiGate models and version pairs. The malware opens a handle to the processes and injects data into them.
  • Versions range from 6.0.5 to 7.2.1
  • Models are FG100F, FG101F, FG200D, FG200E, FG201F, FG240D, FG3H0E, FG5H0E, FG6H1E, FG800D, FGT5HD, FGT60F, FGT80F.
• The malware can manipulate log files. It searches for elog files, which are logs of events in FortiOS. After decompressing them in memory, it searches for a string the attacker specifies, deletes it, and reconstructs the logs.
• The malware can also kill the logging processes.

A Windows samplea analyzed by the experts were compiled on a machine in the UTC+8 timezone, which includes Australia, China, Russia, Singapore, and other Eastern Asian countries.

“The self-signed certificates created by the attackers were all created between 3 and 8 AM UTC. However, it is difficult to draw any conclusions from this given hackers do not nessesarily operate during office hours and will often operate during victim office hours to help obfuscate their activity with general network traffic.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fortinet)

The post Threat actors target govt networks exploiting Fortinet SSL-VPN CVE-2022-42475 bug appeared first on Security Affairs.

New York Congressman-Elect George Santos speaks during the Republican Jewish Coalition (RJC) annual leadership meeting.

David Becker for the Washington Post/via Getty Images

• George Santos told Matt Gaetz that he has lived an “honest life.”
• Santos added that he had “never been accused of any bad doing” and has worked his “whole life.”
• Santos has admitted to falsifying a litany of information about his work experience and education.

Embattled Long Island Rep. George Santos — who has admitted to falsifying key information in his CV — said on Thursday that he’s lived “an honest life.” 

Santos appeared on the podcast “War Room: Pandemic” with Florida congressman Rep. Matt Gaetz on Thursday. During the podcast, Santos told Gaetz he has “lived an honest life” and has “never been accused of any bad doing.” Santos said as well that the money and resources he has are “the equity” of his hard work. 

“I’m going to outwork any of the pundits and talking heads that are out there saying that I should resign, that I’m unfit for office,” Santos said. “The reality is, and the case in point here being is: I’m a workhorse, I’ve worked my whole life. I’m the kid who came from a basic apartment.” 

Gaetz told Santos that some members of the GOP have asked for the Long Island Republican to not be seated on congressional committees, but asked Santos what panels he’d like to serve on anyway. 

Santos responded that he came to Washington, D.C., without “really any preconceived notions of what committees to serve” but said he would “deliver 110%” to his work. 

An investigative report from The New York Times published on December 19 said that companies Santos claimed to have worked with had no record of him. Many other points of doubt have since been raised about Santos’ life, work history, and education. 

The Forward, a Jewish publication, reported in December that they could not find any evidence that the Long Island Republican’s grandparents are Jewish. Santos also claimed to have been “openly gay” for a decade, but The Daily Beast reported that he divorced a woman named Uadla Santos in 2019, two weeks before launching a failed 2020 campaign against Democratic Rep. Tom Suozzi. 

Santos in late December then admitted to lying about working at Goldman Sachs and Citigroup. The congressman also attempted to defend himself against accusations that he lied about being Jewish, saying: “I never claimed to be Jewish, I said I was ‘Jew-ish.” However, in a memo to pro-Israel groups distributed during his campaign, he claimed to be a “proud American Jew.” 

Apart from the red flags on his CV, Santos was also accused by Nassau GOP chairman Joseph Cairo of lying about being a ‘star’ college volleyball player at Baruch College. The CV provided to the Nassau GOP also included the claim that Santos graduated from Baruch College with a high 3.89 GPA. Santos admitted to the New York Post in December that he never graduated from any institute of higher learning. 

Prosecutors in Long Island said on December 28 that they opened an investigation into Santos. Long Island Republicans and the New York State GOP in January called on Santos to resign, but he has refused to do so. 

A representative for Santos did not immediately respond to Insider’s request for comment.

Share SpyTalk

Ana Belen Montes, the most effective and damaging Cuban spy known to have penetrated U.S. intelligence, was a major warrior in the long nasty war between the United States and its communist neighbor. On Jan. 6, after serving 20 years of a 25 year sentence for espionage, she was released from a maximum security prison, perhaps drawing the curtain on the deadly clandestine conflict involving efforts by Cuban exiles and their U.S. allies to reverse the revolution led by Fidel Castro.

By the time of her arrest in 2001, Montes had been a mole inside the Defense Intelligence Agency for 17 years, feeding U.S. secrets to Cuba during the civil wars in Central America, where Cuba and the U.S. military backed opposite sides in conflicts in Nicaragua and El Salvador. Even as the Cold War ended with the dissolution of the Soviet Union and its lifeline of economic and military support for Castro’s regime,  Montes rose in rank and importance in the DIA. She became the agency’s chief analyst in charge of processing U.S. intelligence about the island, earning the sobriquet, “Queen of Cuba,” both for her unrivaled expertise and her imperious manner.

There have been worse breaches of U.S. national security, notably Aldrich Ames and Robert Hanssen, whose spying for the Soviets inside the CIA and FBI led to the deaths and imprisonment of a good number of the CIA’s Russian sources. But Montes’ spying unquestionably dealt devastating blows to U.S. human intelligence and surveillance operations inside Cuba, especially during the 1990s, when Cuban exiles based in Miami were launching what may have been their last concerted effort to overthrow Castro. At least four U.S. agents operating inside Cuba were arrested as a result of information provided by Montes, according to damage assessments conducted after her arrest. 

Jim Popkin, an investigative journalist and former senior editor for NBC News,  tells the story of Ana Montes and the counterintelligence agents at the National Security Agency, DIA and FBI who finally caught her in his engaging and solidly reported book, Code Name Blue Wren, released only a few days before Montes was freed this month. Spy cases are notoriously difficult to write about, especially those involving the spies working for U.S. adversaries. The existence of a mole inside a major intelligence agency is by definition an egregious failure, and such institutions rarely are eager to share the details of a debacle on the scale of Montes’s penetration of the DIA. 

As a lead Cuba analyst in her everyday work at the agency, Montes drafted reports arguing for a softer U.S. policy toward the regime. Popkin, citing his sources, calls her recommendations “disinformation”, but—perhaps ironically—her analysis of Cuba’s deteriorated military capability and conclusion that Cuba no longer posed a significant threat to U.S. national security in the 1990s put her in respectable company. Similar conclusions would become mainstream in policy circles and lead to the eventual rapprochement with Cuba and resumption of diplomatic relations by the Obama administration in 2015.

Popkin seems to have interviewed all the major actors involved in the multiyear counterintelligence operation that —finally—led to her arrest in the days following the 9/11 terrorist attack. (The decision to move against her was accelerated when FBI investigators learned Montes had been promoted and given a major role in the  DIA team planning and selecting targets for the U.S. war against Al Qaeda and the Taliban in Afghanistan.)

Montes was a “true believer,” to borrow the term used by one of the counterintelligence agents who caught her—which differentiates her from better known U.S. moles who turned coat mostly for money. Her parents were from modest families in Puerto Rico, and Ana began the process of radicalization in 1977 during a trip to Spain where her boyfriend was a young leftist who had experienced the worst years of the dirty war in Argentina, Popkin writes.

A gifted academic studying at the prestigious School of Advanced International Studies of the Johns Hopkins University School in Washington, she opposed the Reagan administration’s sponsorship of the Contra fighters seeking to overthrow the leftist Sandinista government in Nicaragua. A Puerto Rican friend—who also happened to be a Cuban agent—encouraged her to go to Havana, where she was recruited by the regime’s intelligence service, originally with the sole idea of supporting the Nicaraguan cause. Popkin mentions that, according to evidence gathered after her arrest, Cuba helped Montes pay off student loans and buy a laptop, but otherwise did not pay her to spy.

One of the most fascinating stories in the book is that of a Cuban-American woman at the secretive National Security Agency who gathered details about the unidentified mole (who turned out to be Montes) by decrypting Cuban radio messages. For example, the messages revealed that the suspected spy had visited the U.S. Guantanamo military base at a certain date, had bought a Toshiba laptop computer, and that Cuba had paid off the agent’s college loan.

The NSA official, given the pseudonym Elena Valdes, doggedly pursued the spy chase for three years, leading to the identification of the DIA as the penetrated agency and the arrest of Montes on Sept. 21, 2001. She first briefed the FBI, which is the primary U.S. agency in charge of counterintelligence. After two years, convinced the FBI was getting nowhere, Elena stepped outside established procedure and, in essence, went behind the FBI’s back. She wrangled an invitation to visit DIA headquarters, and there presented  her packet of decrypted messages to a secure meeting with DIA counterintelligence official Chris Simmons, who showed the kind of investigative enthusiasm she felt was missing at the FBI.

Simmons quickly spotted a clue that would upend the investigation. One of the messages said the unidentified spy had access to something called “safe” as part of his or her work in the unidentified U.S. agency. “Holy shit,” Simmons said. “SAFE” was the acronym for the DIA’s classified database of analyst reports and other investigative materials shared with the CIA and other agencies. The clue meant the spy had to be working at the DIA itself. 

“You’ve been looking in the wrong place,” he exclaimed. “That person has got to be in this building.”

The breakthrough reinvigorated the official FBI investigation. The search now narrowed to the DIA staff, Ana Montes was identified from the other clues, put under surveillance, and taken into custody. 

Inexplicably, Popkin omits a key player in this spy vs spy drama. While Montes was spying inside the DIA for Cuba, the CIA also had a mole inside Cuba’s own intelligence apparatus.  Rolando Sarraff Trujillo was a cryptology specialist in Cuba’s DGI, the intelligence directorate, and he knew the codes Cuba used to communicate with its spies in the United States. He had been recruited to work for the CIA sometime in the 1990s and remained in place, providing the encryption information that allowed the CIA and NSA to crack the code on intercepted shortwave messages. It was his codes that allowed Elena at NSA to read Ana Montes communications with her Cuban handlers. Sarraff was caught by Cuba’s DGI counterspies and imprisoned in 1995.

The omission in Popkin’s book is curious, because it points to the larger context of how the decades of hostility between Cuba and the United States gave way finally in 2014 to what amounted to a ceasefire. The Obama administration negotiated a renewal of diplomatic relations, allowed Cuban exiles to send money to relatives on the island and relaxed travel  restrictions. The truce after a half century of hostility left in place the economic embargo, but introduced an interlude (albeit brief) of almost friendly relations, during which hundreds of thousands of American academics and curious tourists flocked to Cuba, before Donald Trump canceled the detente.

As part of the warming of relations, President Obama negotiated a spy swap.  A U.S. government contractor, Alan Gross, who had been arrested in Cuba in 2009 for smuggling military-grade communications equipment into the country, was languishing in prison in poor health. Washington had always denied Cuba’s charges that Gross was a spy, but saw an opening to spring Sarraff.  The United States was holding three men who had been arrested in 1998 as part of the so-called Wasp network, a group of Cubans spying on militant anti-Castro groups in Florida.

To break the impasse, Cuba agreed to release Gross on “humanitarian grounds” and to exchange Sarraff for the three Wasp spies held by the United States. In announcing the swap, President Obama, referring obliquely to Sarraff, said the unnamed spy was “one of the most important intelligence agents that the United States has ever had in Cuba.” More relevant to the odd lapse in Popkin’s story, U.S. intelligence officials issued a statement saying the exchanged spy’s information had led to the detection and conviction of Cuban spies working in the United States, not just the members of the Wasp network but also Ana Montes. Spytalk editor Jeff Stein, writing for Newsweek at the time,  was one of several reporters to confirm Sarraff’s identity and the link between his cryptography work for the CIA and Ana Montes’ arrest.)

Other than that, Popkin has produced a fine piece of reporting and writing on an intricate, and largely overlooked, spy-vs-spy case. My only other quibble is that he gives barely a nod to the sordid history of the conflict between the United States and Cuba, marked by the U.S. sponsored Bay of Pigs invasion of 1961, the Soviet Union’s secret deployment of nuclear missiles in 1962, which brought the world to the brink of war, and dozens of U.S. plots to assassinate Castro in the 1960s. Perhaps reflecting the attitudes of his hardline sources, Popkin expresses disgust not only for  Montes’s betrayal of her country but also for her leftist friends, notably a prominent SAIS professor whom he ungraciously dismisses as an apologist for Cuba.

Neglecting that history, he is unable to do justice to the remarkable evolution of U.S. relations with Cuba, during and after the time Ana Montes was active, culminating in Obama’s peacemaking with the post-Fidel Castro regime. (He turned over power to his brother Raul in 2006.)  Popkin’s portrayal remains stuck in the anticommunist tropes of many decades ago, when Cuba and its Soviet ally did indeed present a clear and present danger, certainly from the point of view of the United States.

I admit: Mine is perhaps the complaint of a Latin Americanist, grasping for the wider framework of the spy story, rather than the book Popkin actually wrote.  That said, Popkin’s Code Name Blue Wren is unquestionably the most complete telling of this fascinating spy saga and the story of a occasionally brilliant and always morally complicated  woman who decided to spy against her country. 

Former National Public Radio managing editor and Washington Post special correspondent in Chile John Dinges is the author of three widely praised books on Latin America, including, most recently, The Condor Years: How Pinochet and his Allies Brought Terrorism to Three Continents. 

Code Name Blue Wren: The True Story of America’s Most Dangerous Female Spy and the Sister She Betrayed (Hanover Square Press 2023), 351 pages.

(NewsNation) — Lisa Marie Presley, Elvis’ only daughter and a dedicated keeper of her father’s legacy, died Thursday after being hospitalized for a medical emergency. She was 54.

Presley’s death was confirmed by her mother, Priscilla.

“It is with a heavy heart that I must share the devastating news that my beautiful daughter Lisa Marie has left us,” Priscilla Presley said in a statement. “She was the most passionate, strong and loving woman I have ever known.”

Presley’s sudden death left her friends, fans and those in the media who covered her with feelings of devastation, shock and sadness.

“Literally 48 hours ago, she was on screens around the world,” said Sam Rubin, an entertainment reporter for NewsNation affiliate KTLA. Presley was in attendance at the Golden Globes ceremony Tuesday.

Much of her life was filled with tragedy and hardship, beginning with the death of her father when she was 9 years old. She struggled with drugs and some very public marriages — her four husbands included Michael Jackson and Nicolas Cage.

Presley had two children, actor Riley Keough and Benjamin Keough, with her former husband Danny Keough. She also had twin daughters with ex-husband Michael Lockwood.

Benjamin Keough died by suicide in 2020 at the age of 27. Presley was vocal about her grief, writing in an essay last August that she had “been living in the horrific reality of its unrelenting grips since my son’s death two years ago.”

“She’s had a tough life,” entertainment reporter Josh McBride said.

Wayne Scot Lukas, a Hollywood stylist for Janet Jackson, was “devastated” to hear of Presley’s death. He met Presley when she was best friends with Kevyn Aucoin, a makeup artist who did up Presley as Marilyn Monroe for his book “Making Faces.”

“Lisa Marie is a special person, and special people come in this world once in a while and sprinkle fairy dust on all of us and then they leave, and we’re all better for it,” Lukas said. “I wish they could stay longer, but the magic people seem to leave too soon.”

Presley most recently appeared at the Golden Globes, where Lukas said she did not appear to be well.

“I didn’t recognize the person I saw on TV the other night,” he said. He reached out to Janet Jackson to inquire about the health of Presley shortly before she died.

While many might describe Presley’s life as a tragic one, Dana Kennedy, a writer for the New York Post, called Presley “truly heroic” for showing strength in the face of hardship.

“She really tried, and she had beautiful moments in her life and fantastic achievements, as well,” Kennedy said. “She just didn’t really get a break, but she kept on fighting. She was a tough cookie.”

Lisa Marie became the sole heir of the Elvis Presley Trust after her father died. Along with Elvis Presley Enterprises, the trust managed Graceland and other assets until she sold her majority interest in 2005. She retained ownership of Graceland Mansion itself, the 13 acres around it and items inside the home. Her son is buried there, along with her father and other members of the Presley family.

Lisa Marie Presley is a former Scientologist — her son was born in 1992 under guidelines set by Church of Scientology founder L. Ron Hubbard, according to an AP story at the time — but later broke with Scientology.

Actress Leah Remini, who was formerly also a Scientologist, offered condolences on Twitter.

“I’m heartbroken over the passing of Lisa Marie Presley,” she said. “Lisa did not have an easy life, as some might think. May she be at peace, resting with her son and father now. Her mom Priscilla and her three daughters, Riley, Finley, and Harper, are in my prayers.”

The Associated Press contributed to this report.