Home Blog Page 169

eCrime Activities and Hands-on Keyboard Intrusions Rise in H1 2020

Vulnerabilities in Zimbra

A research report from CrowdStrike Inc., the developer of cloud-delivered endpoint protection solutions, revealed that eCrime activities and other malicious actions of state-sponsored actors have increased during the first half of 2020. The “2020 Threat Hunting Report: Insights from the CrowdStrike OverWatch Team” highlighted the intrusion trends and insights into the current landscape of adversary tactics.

The CrowdStrike OverWatch Team stated that they have observed an upsurge in hands-on-keyboard intrusions in the H1 2020 that has already surpassed the total reported intrusions in 2019. The sudden increase in cyberthreats is primarily due to the continued acceleration of eCrime activities by exploiting public fear through COVID-19-themed social engineering techniques.

Key Highlights

  • Sophisticated eCrime activity continues to outpace state-sponsored activity, an upward trend that OverWatch has witnessed over the past three years, accounting for over 80% of interactive intrusions.
  • However, this does not indicate a reduction in nation-state activity, but rather reflects the extraordinary success threat actors have seen with targeted intrusions using ransomware and Ransomware-as-a-Service (RaaS) models, which have contributed to a proliferation of activity from a wider array of eCrime actors.
  • There was a sharp escalation of activity in the manufacturing sector in the first half of 2020 in terms of both the quantity and sophistication of intrusions from both eCriminals and nation states, making it the second most targeted vertical observed by OverWatch.
  • Health care, food, and beverage industries also saw increased targeting, suggesting that adversaries have adjusted their targets to the shifting economic conditions resulting from the pandemic, focusing on industries made vulnerable by complex operating environments that experienced sudden changes in demand.
  • The telecommunications industry continues to be a popular target for the nation-states, specifically China. OverWatch observed six different China-based actors, whose motivations are likely associated with espionage and data theft objectives, conducting campaigns against telecommunications companies in the first half of the year.

Jennifer Ayers, Vice President of OverWatch and Security Response, said, “Just like everything this year, the threat landscape has proven unpredictable and precarious as eCrime and state-sponsored actors have opportunistically taken aim at industries unable to escape the chaos of COVID-19, demonstrating clearly how cyber threat activity is intrinsically linked to global economic and geo-political forces. OverWatch threat hunting data demonstrates how adversaries are keenly attuned to their victim’s environment and ready to pivot to meet changing objectives or emerging opportunities.”

It is time for organizations to implement a layered defense mechanism that incorporates endpoint detection and response (EDR), threat hunting, password management, and employee awareness to enhance their cybersecurity posture.

U.K. NCSC Launches New Vulnerability Reporting Toolkit

NCSC

The U.K.’s National Cyber Security Centre (NCSC) released a new “Vulnerability Reporting Toolkit,” which is intended to help organizations manage their vulnerability disclosure processes in a simplified manner. The Toolkit is helpful for all types of organizations that are planning to implement a vulnerability disclosure process in their system. It provides a comprehensive guide to develop a disclosure program that was built based on three essential components, which include Communication, Policy, and Security.txt.

“Security vulnerabilities are discovered all the time and people want to be able to report them directly to the organization responsible. The NCSC’s Vulnerability Disclosure Toolkit contains the essential components you need to set up your own vulnerability disclosure process,” NCSC said in a statement.

Importance of Vulnerability Reporting

Vulnerability reports from bug hunters provide critical information about existing vulnerabilities in the systems that can be used to fix the issues and improve the security posture. “Having a clearly signposted reporting process demonstrates that your organization takes security seriously. By providing a clear process, organizations can receive the information directly so the vulnerability can be addressed, and the risk of compromise reduced. This process also reduces the reputational damage of public disclosure by providing a way to report, and a defined policy of how the organization will respond,” NCSC added.

How to Respond to Vulnerability Reports

The NCSC recommended certain steps to effectively respond to a vulnerability report, these include:

  • Do not ignore the report. Respond promptly to the finder (bug hunter) and thank them. Feedback encourages engagement and they will be more inclined to help you again in the future.
  • Pass the report to someone in your organization who is responsible for the affected product or service. If it is managed by a third-party, discuss the report with them.
  • Avoid forcing the finder to sign documents such as non-disclosure agreement (NDA) as the individual is simply looking to ensure the vulnerability is fixed.
  • If you need more information to confirm and fix the issue, you should politely request that additional information from the finder.
  • Once you have decided on a course of action, let the finder know that the issue is being managed. You do not need to provide lots of technical information or commit to timescales.
  • If the issue takes time to fix, you should send periodic updates back to the finder.
  • Once the issue is fixed, let the finder know. They might be able to retest the issue to confirm the fix.
  • Consider publicly acknowledging and thanking the finder as this creates a sense of trust and transparency.

“The toolkit is not an all-encompassing answer to vulnerability disclosure. If you do not have a vulnerability disclosure process, then the toolkit can help you create one. We believe it is worth establishing a process in advance. The toolkit is deliberately easy to implement, so you can adopt it at short notice. Even if you already have a process in place, take a look at the toolkit as it may help you to improve on what you have already set up,” NCSC concluded.

To help prevent growing cyberattacks, vulnerability reporting will be embedded into the U.K. government’s legislative framework, which will require makers of smart devices to provide a public point of contact as part of a vulnerability disclosure policy.

Telstra Forms Alliance with ACSC and Services Australia to Eradicate Phishing Texts Spoofing

Cryptocurrency scams in Australia

Australia has been a hotbed for cyberattacks and the country’s Prime Minister, Scott Morrison, has been very vocal about it. Owing to the surge in cyberattacks, especially targeted towards the country’s critical infrastructure, Morrison recently allocated AU$1.66 billion (approximately US$1.19 billion) funds to bolster the cybersecurity defenses for enterprises. However, as a personal recommendation, he also asked businesses to ramp up their own defenses and help the greater cause of defending Australian citizens from such malicious activities. In response to his request, Telstra has now taken the initiative and partnered with the ACSC and Services Australia to launch a pilot project for block phishing texts from reaching Telstra’s customers.

How to make SMS’s Safer

Telstra’s announcement created curiosity as to how exactly blocking phishing texts would be possible. To clear the air, it explained, “when a text message is sent over our network, using information called “metadata”, we can identify and reject illegitimate phishing text messages impersonating a specified SenderID before they reach Telstra customers.”

Telstra has worked closely with the ACSC and Services Australia to create an officially approved list of sources associated with SenderIDs, like myGov or Centrelink. This means that any message with a SenderID that originates from an unapproved source will be blocked from transmitting it through to the Telstra customers.

Anyone and Everyone is a Target

Telstra believes that at a time when scammers are taking increasing advantage of the COVID-19 pandemic, anyone and everyone with a connected device in hand is a potential target for them. It also shared a screengrab to demonstrate how scammers are convincingly producing phishing texts and links to make their customers believe in the authenticity of the text message.

block phishing texts
Image Credit: Telstra Exchange

It is to be noted that scammers impersonate names of government agencies to increase their chances at appearing legitimate.

Phase One of the project is currently being rolled out, while the other is anticipated to be rolled out in the next few months to help protect larger groups of customers from such malicious scammers.

Telstra’s CEO, Andy Penn said, “Cybercriminals continue to target Australians through SMS phishing campaigns by sending them text messages that attempt to redirect them to malicious websites. Being able to stop these scammers in their tracks will go a long way to protecting our customers With so many Australians now working from home as well as relying on Government assistance through Services Australia, it’s vital that we constantly evolve our approach in defending against malicious activity on our networks. It is now more important than ever to protect its customers.”

Strategic Alliance! Abnormal Security and Microsoft to Deliver Comprehensive Email Security

Abnormal Security Partners with Microsoft to Boost Cybersecurity

Cybersecurity solutions provider Abnormal Security announced its strategic alliance with Microsoft to provide comprehensive cloud email security and other cybersecurity solutions to organizations. The partnership integrates Abnormal’s security platform with Microsoft Azure to further enhance existing capabilities for advanced security.

Based in San Francisco, CA., Abnormal Security protects organizations from advanced targeted attacks including spear-phishing and business email compromise attacks. Its cloud-native architecture and AI platform provide an inside-out understanding of people and organizational processes to prevent targeted email attacks.

Evan Reiser, Co-founder and CEO at Abnormal Security, said, “When considering the right cloud infrastructure, startups need to look at both the technology platform and the business opportunity. As a cybersecurity company, we were very intrigued with Azure’s inherent security, privacy, and AI offerings and as a startup, Microsoft’s go-to-market support and access to the largest enterprises is unmatched.”

Abnormal’s new security offering will be directly available for purchase on Microsoft’s Azure Marketplace.

Jeffrey Ma, VP Microsoft for Startups said, “Microsoft for Startups helps B2B startups use the Microsoft platform to scale their business quickly and deliver innovative AI-powered solutions to enterprise customers.”

Microsoft’s New Integrations

Recently, automotive cybersecurity firm Upstream Security joined the Microsoft Intelligent Security Association to establish an ecosystem of leading software vendors that have integrated their solutions to better defend against automotive cyberattacks.  Upstream also revealed that its C4 platform and Microsoft Azure Sentinel will help enable detection, investigation, and remediation for threats targeting connected vehicles and smart mobility services. Through this integration, alerts from Upstream C4 can be used to automate responses based on an OEM vehicle manufacturer’s or connected fleet’s unique security policies. Upstream’s C4 platform leverages existing automotive data feeds to detect threats in real-time and delivers cybersecurity insights supported by AutoThreat Intelligence.

Taiwan to Establish Cybersecurity Excellence Center by 2022

Industrial Cybersecurity

In a bid to boost cybersecurity of the nation and to bolster information security talent, Taiwan would be establishing a cybersecurity excellence center in the country by 2022. A budget of NT$818 million (US$28 million) has been earmarked for the initiative, which will not only spearhead cybersecurity innovation but will also address the cybersecurity skill gap in the country. The cybersecurity excellence center is aimed at making Taiwan the Asian hub of high-end information security professionals and innovation.

The excellence center will serve as a corporate base for Taiwan’s cybersecurity infrastructure. Vice President Lai Chin-te while addressing the Taiwan Hackers Annual Conference HITCON 2020, earlier this year, had noted that “with Taiwan aiming to become a smart country to jump on the Industry 4.0 bandwagon like other global countries, information security has become more important than ever.”

According to Liberty Times, the cybersecurity excellence center will focus of three key areas. These include network security, password security and information security. The nation will also proactively drive innovation to defend its infrastructure from the increasing threat vectors like malware campaigns and state-sponsored attacks.

With the nation witnessing an average of 300 million cybersecurity scams and over 30 million attacks every month originating from neighboring countries like China, cybersecurity of Taiwan is of paramount importance. It is estimated that Taiwan’s cybersecurity market is expected to reach a net worth of 78 billion by 2025.

Among the notable cybersecurity initiatives adopted by the country, Department of Cyber Security, Executive Yuan proposed the “Action Plan for Cybersecurity Industry Development (Draft)” based on the conclusions of the Strategy Review Board Meeting (SRB) and the “National Cyber Security Program of Taiwan (2017-2020)” promulgated in November 2017. As of today, the said program, which includes “promoting the cybersecurity industry’s capacity” in the key tasks of promoting the medium-term/long-term development of national cybersecurity infrastructure, has been implemented for three consecutive years,” suggests a study commissioned by the Netherlands Enterprise Agency titled ‘Research of Cyber Security Industry in Taiwan.

PII of 46,000 U.S. Veterans Compromised in a Data Breach

U.S. Military Personnel and Veterans

The U.S. Department of Veterans Affairs (VA) Office of Management disclosed a data breach incident that exposed the sensitive information of around 46,000 veterans. In an official release, the authorities stated that one of the Financial Services Center’s (FSC) application was accessed by unauthorized users through social engineering techniques to divert the payments to community care providers for the Veterans’ treatment.

The FSC took the application offline temporarily and reported the incident to the regulators for further investigation. “To prevent any future improper access to, and modification of information, system access will not be re-enabled until a comprehensive security review is completed by the VA Office of Information Technology,” the notice said.

The FSC stated that it will notify the affected users and take necessary actions to prevent and mitigate any potential damage. The department is also offering free credit monitoring services for the affected Veterans in the data breach. “Veterans whose information was involved are advised to follow the instructions in the letter to protect their data. There is no action needed from Veterans if they did not receive an alert by mail, as their personal information was not involved in the incident,” the notice added.

Not the First Time

This is not the first time that cybercriminals targeted the Veterans in the U.S. Earlier, security researchers from Cisco Talos discovered a threat group targeting the U.S. military Veterans via a fake job portal promising help for those looking for jobs. To trick users into finding jobs, hacker group Tortoiseshell targeted Americans who are in search of jobs, especially military Veterans via a phony website, hxxp://hiremilitaryheroes[.]com, which is a lookalike of the legitimate website, https://www.hiringourheroes.org.The phony URL directs the victims to another fake site and prompts them to download an app, which is a malware downloader that deploys spying and other malicious tools.

“Cyber Partisan” Hacker Group Threatens to Mass Hijack Key Public Systems in Belarus

Ransomware gangs

Belarus, the former part of the Soviet Union, has always had a political turmoil since gaining freedom in 1991. But currently, the unrest has reached a level higher as mass protests broke out from August 9, 2020, against the country’s re-elected President Alexander Lukashenko. The demonstrators believe that the results of the recently concluded presidential elections were rigged and have thus warned him of mass hacking operations that can lead to disruption of multiple public services if he failed to comply with their demands.

The Threat from “Cyber Partisans”

A Belarusian hacker group, by the name “Cyber ​​Partisans,” published a direct threat note on a Telegram channel addressing President Lukashenko that they would bring down the critical public control systems in the nation if protesters are continued to be detained. The note was accompanied by a picture hinting the possibility of hacking attempt on the Ministry of Taxes and Duties’ official website.

The published post said,

“Alexander Lukashenko, we address you personally: It will be very painful… first the tax system will go down, then the electricity in the country will run out, then the banking system will go down… Do you need it?”

Additionally, the hackers threatened they would “kill the ruble” and start blocking the bank accounts of people from Lukashenko’s inner circle.

Threat in Australia

Earlier this year, Australian banking and financial institutions received threat emails indicating a possibility of distributed denial of service (DDoS) attacks against them. However, the motive here was different, it was plainly financial gain. To avert the consequences, the extortioners by the name “Silence Hacking Crew” demanded a ransom to be paid in the form of Monero (XMR) cryptocurrency.

Marriott, British Airways, and EasyJet Websites are Vulnerable to Attacks

Domain Name Security

A new investigation from the consumer advocacy organization Which? has uncovered hundreds of critical security vulnerabilities on the websites of popular airlines, hospitality chains, and travel companies. Which? researchers and security experts from 6point6 evaluated the security of websites of 98 companies in the travel industry, including cruise lines and booking sites, in June 2020. The researchers found that Marriott, British Airways, and easyJet were in the top five companies with the most security vulnerabilities. These three firms already suffered data breaches earlier, which resulted in hundreds of millions in fines from data regulators.

A Century of Vulnerabilities

The researchers found 497 flaws on Marriot owned websites, in which 96 vulnerabilities deemed as high severity and 18 ranked as critical. “Three critical vulnerabilities were found on a single website of one of Marriott’s hotel chains, involving errors in the software used to run the website potentially allowing an attacker to target the site’s users and their data,” Which? said.

European airline easyJet, which recently suffered a data breach that compromised details of 9 million customers, was found to have 222 vulnerabilities across  nine of its websites. If exploited, attackers could hijack users’ browsing sessions. EasyJet took down three domains and fixed the vulnerabilities on the other six websites. “None of these subdomains were linked to easyJet.com, and it has seen no evidence of any malicious activity on these sites and none store any customer passwords, credit card details or passport information,” EasyJet’s spokesperson said.

The researchers also discovered 115 vulnerabilities on British Airways’ websites, in which 12 flaws were found to be critical. “We take the protection of our customers’ data very seriously and are continuing to invest heavily in cybersecurity. We have multiple layers of protection in place and are satisfied that we have the right controls to mitigate vulnerabilities identified,” said a British Airways spokesperson.

American Airlines has over 291 potential vulnerabilities across its websites, with seven critical and 30 high-severity flaws. “We use a combination of internal and external cyber professionals to regularly identify and test the security of our systems and continue improving our capabilities,” American Airlines responded.

Critical vulnerabilities in Lastminute.com’s 153 subdomains were also found, which could allow an attacker to manipulate pages, access sensitive information like session cookies, browsing history, and create fake login accounts.

Irrespective of the severity, security vulnerabilities could cause severe damage to an organization’s security infrastructure. Attackers can exploit these flaws for their advantage. Organizations in the travel industry must gear up their cybersecurity measures to protect their customers from cyberattacks. If not, they should be ready to face the punitive actions or hefty fines from the data regulators.

Red Teaming: Simulating Targeted Cyberattacks

red and blue teaming

When it comes to cybersecurity, no organization can be 100 percent safe. Even organizations that use advanced security technologies may face problems with such key elements as people, business processes, technologies, and associated intersection points.

There are many methods that help to evaluate the protection level: analysis of the security of systems and applications, penetration testing, assessment of personnel security awareness, etc. However, due to the constant change in the cyberthreat landscape, and the emergence of new hacking tools and criminal groups, new types of risks arise that are difficult to identify using traditional methods.

By David Balaban, Computer Security Researcher

One of the most advanced approaches to test the security level of any organization is Red Teaming — a continuous assessment of the security of information systems, as well as the preparedness of incident response specialists, and the infrastructure’s resistance to new types of attacks, including APT and targeted attacks.

By utilizing the Red Teaming approach and practicing the response to controlled attacks, the internal security teams can enhance their skills in identifying previously undetected threats and thus stop real intruders in the early stages of the attack preventing monetary and reputation damages to the business.

Red Teaming. What is it?

Red Teaming is a comprehensive and most realistic way to test an organization’s ability to resist complex cyberattacks using advanced methods and tools from the arsenal of hacker groups.

The main idea of ​​this exercise is not only to identify potential weaknesses and vulnerabilities that were not detected using standard testing methods, but also to assess the organization’s ability to prevent, detect, and respond to cyberattacks.

Red Teaming helps an organization to understand:

  • How security tools protect important assets.
  • Whether the early warning and monitoring systems are configured correctly.
  • What opportunities attackers must penetrate the internal infrastructure.

Security assessment and training should strive to be maximally realistic and close to real-life situations. The organization’s security team (Blue Team) should not be informed of the start of the project so that the Red Team can model the actions of real attackers based on specific threat analysis and try to breach the infrastructure.

“Cyber-drills” that use the Red Teaming format are most effective for companies with a mature level of information security. Such drills are not limited in time and are focused on achieving different goals, whether it is gaining access to network nodes or sensitive information by any available means. The actual scenarios of Red Teaming are unique for each organization and depend on the goals set.

Commonly used scenarios include:

  • Active Directory forest take over.
  • Getting access to top managers’ devices.
  • Imitation of theft of sensitive customer data or intellectual property.

Read Teaming vs. Penetration Testing

Despite the fact that Red Teaming and Penetration Testing use similar cyberattack tools, the goals and results of both approaches are different.

Red Teaming

The Red Teaming process simulates real targeted attacks aimed at an entire organization. The essence of this approach is the continuous probing of information systems attack resistance. Continuous deep probes provide a comprehensive understanding of how secure the infrastructure is, whether employees are aware of new threats and whether the internal processes of the organization are effective when they are exposed to a real attack.

Penetration Testing

Penetration testing specialists attempt to exploit vulnerabilities and increase their privileges in the systems in order to assess the possible risk from these rogue activities. Pentests do not test readiness to identify and respond to information security incidents.

Below are some of the differences between Red Teaming and Penetration Testing:

Red Teaming and Penetration Testing complement each other. Each approach is important and useful for the organization in its own way, since in the course of such a combined test, it is possible to evaluate both the passive security of the systems and the active security of the company.

Red Teaming in Action

Red Teaming can be divided into several successive stages. To increase efficiency, and considering the limited time, some activities within the main stages, may begin earlier or be performed in parallel with others. Therefore, in practice, the Red Teaming process is not such a clear linear sequence of steps.

More information about each stage:

1. The preparatory stage. Duration: 4 to 6 weeks.

During this stage, the current needs of an organization get assessed, and the amount of work gets calculated. Also, at this stage, the key points for conducting Red Teaming are specified and the official launch of the project is announced:

  • A working group is created consisting of representatives of the Customer and the Contractor.
  • The scope of work is determined (duration, volume, prohibited actions, etc.)
  • Interaction protocols get created.
  • The Red Team is formed according to the needs of the current project.

2. Active Red Teaming stage. Duration: 12 weeks or more.

At this stage, the Red Team:

  • Runs Threat Intelligence.
  • Develops scenarios based on crucial system functions and threat models.
  • Forms a plan and attempts to attack agreed targets (assets, systems, and services that contain one or more important business functions.)

This stage can be divided into two sub-stages: cyber intelligence and scenario development, as well as testing/attacking in the Red Teaming format.

3. The final stage. Duration: 2 to 4 weeks.

All penetration activities get completed once all the planned steps have been successfully completed, or the time allotted for work has expired.

At this stage:

  • The Red Team prepares a report describing its work, prepares conclusions and observations on the company’s ability to detect and respond to threats.
  • The Blue Team prepares its own report describing the actions taken based on the chronology of the report of the Red Team.
  • All participants exchange results, analyze them, and plan further steps to improve the organization’s cyber protection.

Parties involved in the Red Teaming process are:

  • The White Team, which consists of a manager, representatives of the Customer’s business units, and the required number of security experts who will know about the project.
  • The Blue Team – Customer’s security department responsible for the detection and response to information security incidents.
  • The Red Team, which consists of a manager and several security experts simulating targeted attacks.

Methodology

To simulate attacks on a specific target, Red Teams should use proven methodologies that include best practices and adapt them to a specific Customer’s cyber landscape.

The life cycle of security assessment utilizing the Red Teaming format follows the model of The Cyber ​​Kill Chain and has the following general steps: reconnaissance, weaponization, delivery, exploitation, installation, obtaining control, and performing actions in relation to the target.

The Real-life Red Teaming Case

Accessing Active Directory

The Customer was a group of companies operating in the heavy equipment production segment. The goal is to gain administrative access to the Active Directory domain controller at the company’s headquarters.

In the course of the project, it was found that the Customer uses multi-factor authentication (smart cards) for all types of access, including remote and external web services. The use of social engineering was prohibited.

The Red Team actions and results

Security experts conducted a thorough reconnaissance and determined that this organization acquired 12 companies and reorganized them into its subsidiaries right at the time of the Red Teaming operations.

The Red Team managed to get permission to conduct an attack on all the new companies in this group. One of the subsidiaries had very weak cyber-protections. Domain controllers – branchoffice1.domain.com were “hacked” and a VPN was discovered connecting the branch office local networks (Full-Mesh site-to-site VPN.)

The network connection was well protected but trust mechanisms between Active Directory forest domains did not work for controllers on the branchoffice1.domain.com so it was possible to spread the attack and breach the branchoffice2.domain.com, gaining administrator rights there.

Using the Kerberos “golden ticket” attack, the Red Team bypassed the smart cards protection at a “low level” due to the implementation features/failures of the Kerberos protocol. By exploiting the trust mechanism between Active Directory domains, the Red Team managed to obtain administrative rights at the head office. Thus, the domain controllers at headquarters were successfully hacked and experts achieved the goal of the Red Teaming project.

Conclusion

By conducting Red Teaming and practicing the response to controlled attacks, the internal security team can improve its skills in identifying previously undetected threats and stop real attackers in the early stages of the intrusion.

Security training that utilizes the Red Teaming approach gives the organization an idea of ​​the strengths and weaknesses of its cybersecurity posture and allows to define an improvement plan for the continuity of business processes and the protection of valuable data.

By adding Red Teaming as part of its security strategy, a company can measure security improvements over time. Such measurable results can be used for the economic feasibility of additional information security projects and the introduction of new technical means of protection.

About the Author

David BalabanDavid Balaban is a computer security researcher with over 15 years of experience in malware analysis and antivirus software evaluation. David runs the Privacy-PC.com project which presents expert opinions on contemporary information security matters, including social engineering, penetration testing, threat intelligence, online privacy, and white hat hacking. As part of his work at Privacy-PC, Mr. Balaban has interviewed such security celebrities as Dave Kennedy, Jay Jacobs and Robert David Steele to get firsthand perspectives on hot InfoSec issues. David has a strong malware troubleshooting background, with the recent focus on ransomware countermeasures.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Netlogon Vulnerability: Patch Before Hackers Become Your Admin

Microsoft November 2021 Patch Tuesday, Windows 10, Microsoft PrintNightmare

A recent vulnerability on Netlogon patched in the Microsoft August Patch Tuesday was a nightmare, reaching a CVSSv3 score of 10.0. The vulnerability dubbed as ‘Zerologon,’ also identified as CVE-2020-1472, could allow attackers to hijack the Windows domain controller. All an attacker requires is local network access, which is also why it cannot be performed directly over the internet. However, if an attacker sets their foothold in the target environment, they can change the administrator password on any Windows Domain Controller they can reach.

According to Satnam Narang, Staff Research Engineer Security Response, Tenable, “This scenario [attacker exploiting a vulnerability to reset the password of the domain administrator on an organization’s domain controller] is a game over situation for any organization.”

“The impact of the flaw is limited to an attacker who has already gained a foothold inside an organization’s network. Despite this limitation, an attacker could leverage any number of existing unpatched vulnerabilities to breach its target network before pivoting to compromise the vulnerable domain controller. Additionally, we foresee this flaw being a compelling addition to the toolkit of ransomware gangs, who have already wreaked havoc on private organizations, educational institutions, and governments over the last few years,” Narang said.

The Second Wave, Only Deadlier

The vulnerability was discovered by Secura’s security expert Tom Tervoort, who had also discovered the Netlogon vulnerability last year. In comparison to the current one, the earlier vulnerability was less severe. A blog by Secura also noted that Tervoort, after forging an authentication token for specific Netlogon functionality, was able to call a function to set the computer password of the Domain Controller to a known value.

According to Secura, “The vulnerability stems from a flaw in a cryptographic authentication scheme used by the Netlogon Remote Protocol, which among other things can be used to update computer passwords. This flaw allows attackers to impersonate any computer, including the domain controller itself, and execute remote procedure calls on their behalf.”

Exploit Scripts are Already Available on GitHub

Everybody is urged to install the patch on all their domain controllers as soon as possible. “As we’ve already seen, several exploit scripts for this vulnerability are published to GitHub, which provides a blueprint for defenders and attackers; we strongly encourage organizations to apply the patches provided by Microsoft immediately. If your domain controllers are running unsupported versions that are no longer receiving security updates from Microsoft, it is imperative to upgrade those as soon as possible.” Narang added.

1...168169170...410Page 169 of 410