Thought leadership. threat analysis, news and alerts.
Microsoft Windows Privilege Escalation Vulnerability Leaked via Twitter
A security researcher who goes by the name “SandboxEscaper” leaked via Twitter an exploit code for a Microsoft Windows privilege escalation vulnerability.
In the now-deleted Twitter post, SandboxEscaper provided a link to a Github repository that contains the code necessary to exploit a Microsoft Windows privilege escalation vulnerability. Other security researchers have since verified the authenticity of the vulnerability exploit disclosed by SandboxEscaper.
The bug uncovered by SandboxEscaper lies in Microsoft Windows task scheduler service. Task scheduler allows users to schedule any program to run at a convenient time or when a specific event occurs.
SandboxEscaper found that task scheduler uses unsecured API that allows an attacker, having access to a computer as a local user to gain system-level privileges, enabling the attacker to overwrite system files with malicious code to hijack Windows.
“The Microsoft Windows task scheduler SchRpcSetSecurity API contains a vulnerability in the handling of ALPC, which can allow an authenticated user to overwrite the contents of a file that should be protected by filesystem ACLs,” CERT Coordination Center (CERT/CC)described the uncovered flaw. “This can be leveraged to gain SYSTEM privileges.”
“The flaw is that the Task Scheduler API function SchRpcSetSecurity fails to check permissions,” security researcher Kevin Beaumont, for his part, noted. “So anybody – even a guest – can call it and set file permissions on anything locally.”
As a proof-of-concept, SandboxEscaper overwrites a file used by Windows' printing subsystem with a malicious code when an attempt is made to print.
According to CERT/CC, the exploit code leaked by SandboxEscaper works on 64-bit Windows 10, Windows Server 2016 systems, 32-bit Windows 10 with minor modifications and with other Windows versions with further modifications. CERT/CC said it’s currently unaware of a practical solution to this problem.
A Microsoft spokesperson told the Registerthat the company will “proactively update impacted devices as soon as possible.”
In another Twitter post, SandboxEscaper blamed depression for leaking the vulnerability exploit before Microsoft has time to issue a security update or a patch.
Exploits for privilege escalation vulnerabilities are rarely leaked to the public prior to a patch as many software vendors like Microsoft now offer financial rewards to security researchers who uncover and discreetly inform the concerned software vendors. This gives security vendors time to create a security fix to the reported problem.
Dangers of Privilege Escalation Attacks
In a privilege escalation attack, the attacker has to have local access to the computer or computer network that he or she wants to compromise. A local user needs the system administrator's password to complete certain tasks, such as overwriting system files. As such, this is given less priority by software vendors when it comes to patching.
Remote code execution attacks, on the other hand, are given high priority in terms of patching as these attacks don’t require that the attacker have local access to the target computer.
In a remote code execution attack, an attacker can install malicious code on a computer even when he or she has no local access, provided though that the computer is connected to the internet. An example of the remote code execution attack was the WannaCry attack. Hours after the WannaCry attack on May 12, 2017, Microsoft issued a security update for Windows platforms originally not covered by an earlier security patch, showing the importance of patching remote code execution attacks.
Privilege escalation attacks, however, aren’t given similar immediate attention. Privilege escalation vulnerabilities are typically patched during scheduled updates, like Microsoft’s regular security updates every second Tuesday of each month.
Client-side exploits, however, make privilege escalation attacks dangerous as attackers then effectively become local users and escalate their privileges to system administrators.
"If an attacker can gain access to a system through a client side exploit, they may then effectively become the local user, and escalate to local system,” SANS Technology Instituteinstructor Adrien de Beaupre wrote in a post "Privilege escalation, why should I care?" “Local system priv on a Windows computer is just a hop, skip, and jump away from being Domain administrator.”
Client-side exploits come in numerous and varied formats. Compared to remote execution attack like the WannaCry that has worm capability – meaning, it replicates itself without user interaction, client-side exploits need user interaction, such as clicking a malicious link or downloading a malicious email attachment.
The fact that the exploit code is out and there’s no official patch from the software vendor should warrant some caution. However, unofficial patch has been posted by 0Patch.com
“Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible,” a Microsoft spokesperson told Threatpost. “Our standard policy is to provide solutions via our current Update Tuesday schedule.”
That means that the next Windows update is still days away – this coming September 11th. This gives attackers a window to exploit the flaw exposed by SandboxEscaper in the wild.
According to Kevin Beaumont, if you use Microsoft Sysmon, a sure way to find out whether a Microsoft Windows task scheduler exploit is being used is by looking for spoolsv.exe spawning abnormal processes.
Here are some general measures in preventing privilege escalation attacks like the one exposed by SandboxEscaper:
Critical Security Flaw Meltdown and Spectre Explained
Meltdown and Spectre are critical security vulnerabilities that affect most modern computer processors and operating systems. These vulnerabilities allow computer programs to steal sensitive data processed on the computer.
Meltdown’s official name is CVE-2017-5754. Spectre is the collective name for 2 vulnerabilities, CVE-2017-5753 and CVE-2017-5715. CVE stands for common vulnerabilities and exposures. It’s a system that provides official references for publicly known cybersecurity vulnerabilities.
A typical computer program isn’t allowed to read data from other computer programs. What Meltdown and Spectre do is access the data stored in the memory of other running computer programs. Data that could be accessed by these vulnerabilities include photos, instant messages, emails and passwords stored in a browser or password manager.
What is Meltdown?
What Meltdown does is break the barrier that isolates computer programs and the operating system. By breaking this barrier, a Meltdown attack could access the operating system and other programs.
Meltdown was independently discovered by security researchers from Google Project Zero, Cyberus Technology and Graz University of Technology.
According to the security researchers who discovered Meltdown, this vulnerability potentially affects every Intel processor which implements “out-of-order execution” meaning, every Intel processor produced since 1995, except Intel Itanium and Intel Atom before 2013. Meltdown has also been shown to potentially affect other processors including ARM and AMD.
Cloud providers which use Intel CPUs and Xen PV and cloud providers without real hardware virtualization may also be potentially affected.
What is Spectre?
What Spectre does is break the barrier that isolates different computer programs. It also tricks a computer program that follows security practices into leaking data.
Spectre was independently discovered by Jann Horn of Google Project Zero and
According to the security researchers who discovered Spectre, almost every modern desktops, laptops, mobile devices and cloud servers are potentially vulnerable. In particular, Intel, AMD and ARM processors are known to be potentially vulnerable to Spectre.
Similarities Between Meltdown and Spectre
Here are the similarities between Meltdown and Spectre:
It’s difficult to detect these vulnerabilities as they don’t leave any traces in traditional log files. They’re also difficult to detect as antivirus, for instance, find it hard to distinguish an error-free computer program from Meltdown or Spectre.
Difference Between Meltdown and Spectre
The difference between Meltdown and Spectre is that while Meltdown cracks the barrier that prevents programs from accessing the computer memory, Spectre tricks other computer programs into accessing arbitrary locations in their memory.
Researchers who discovered Meltdown and Spectre said they don’t know whether these vulnerabilities have been exploited into the wild. ProjectZero team at Googlepublicly disclosed these vulnerabilities on January 3, 2018. The team reported these security issues to Intel, AMD and ARM on June 1, 2017.
Intel’s January 2018 press statementstates that the company will issue security updates for at least 90% of Intel CPUs introduced in the last 5 years by January 15, 2018, while security updates for the remaining CPUs will be available by the end of January.
In Intel’s latest press statement, the company said it won’t issue security updates for Spectre for the following processors: Bloomfield line, Clarksfield, Gulftown, Harpertown line, Jasper Forest, Penryn/QC, SoFIA 3GR, Wolfdale line and Yorkfield Line.
Here’s Intel’s explanation why it won't issue security updates of the above-mentioned chips:
“After a comprehensive investigation of the microarchitectures and microcode capabilities for these products, Intel has determined to not release
microcode updates for these products for one or more reasons including, but not limited to the following:
Most of the above-mentioned unsupported Intel processors are more than 5 years old, some even are more than a decade old, with exception of SoFIA 3GR which was released only in 2015.
According to Microsoft, it has released several security updates to mitigate the effects of Meltdown and Spectre. The company added that it took action to protect its cloud services against these vulnerabilities. “Microsoft has released several updates to help mitigate these vulnerabilities,” Microsoft said in a statement. “We have also taken action to secure our cloud services."
How to Protect Your Organization’s Computers from Meltdown and Spectre
Here are some of the preventive measures to protect your organization’s computers from these vulnerabilities:
Meltdown and Spectre affect a number of computer processors, not just Intel. These vulnerabilities also affect operating systems, not just Windows. According to Microsoft, users of Windows operating systems should apply the January and February 2018 Windows security updates as well as the monthly Windows security updates.
According to Carnegie Mellon University Software Engineering Institute, there have been reports that the overall CPU performance is impacted by many of the available patches for these vulnerabilities.
“While we recognize that replacing existing CPUs in already deployed systems is not practical, organizations acquiring new systems should evaluate their CPU selection in light of the expected longevity of this vulnerability in available hardware as well as the performance impacts resulting from the various platform-specific software patches,” Carnegie Mellon University Software Engineering Institute said.
Top 7 Cyber Security Tools for Your Business
With so much of our information online, everyone is vulnerable to hackers and cyber-thieves. When it comes to business, a cyber invasion is a constant threat.
Short term loss could be financial, intellectual property theft, data loss, or worse.
The real threat is the long term loss of trust and reputation damage that could take years to repair. If your clients' information is exposed, it will be hard for them to consider it safe to give you their business again.
Protect your business with these 7 cyber security tools.
7 Cyber Security Tools Your Business Must Be Using
In order to protect your business' digital information, you need a variety of cyber security tools in place.
For complete peace of mind, you'll want to work with a trusted cyber security partner. In the mean time, these tools are a great place to start.
1. Malware Scanners
Malware is short for malicious software. It is designed by hackers to gain access to a computer without the owner's knowledge.
You must have specific anti-malware cyber security tools in place to detect any hacker invasion.
There are a variety of malware scanners out there, many even available for free (with limited features).
Protect your business with automatic malware scanners in place.
2. Routine Patching
Patching is the process of installing a piece of software that repairs any security flaws. Updating an app is an example of patching.
Picture your business's digital infrastructure as a house. Each time you add a new application, piece of software, etc. it's like adding a new room to the house.
Software, apps, and the like are built by humans, meaning that there is room for human error. Human error is like an unlocked door or unfinished window in one of the new rooms.
This can leave a welcome mat out to cyber attackers. That's why your security plan needs to include routine assessments and patching.
3. Two-Factor Authentication
Use two-factor authentication to add a difficult-to-hack layer of security to your log in systems.
Examples include a verification code sent to a linked phone number or a piece of information only the user would know.
4. Restrictive Administrative Access
Add an additional security level for your most sensitive information and infrastructure by restricting who can access it.
Click here for more information on how to implement restrictive admin mode.
5. Network Segmentation
Divide your computer network into sub networks to improve security and performance.
This allows you to isolate the most sensitive data to a specific network to limit access and decrease congestion.
6. Vulnerability Scanning
There's no better way to access your security levels than a vulnerability scan.
Try our free vulnerability assessment to find weaknesses in your code and how to remedy them.
7. 24/7 Security Monitoring
Cyber security protection doesn't come in the form of a quick fix.
Continually protect your business' data with a 24/7 security monitoring system in place to catch attacks the minute they happen.
Protect Your Business for Peace of Mind
Cyber security tools are of the utmost importance for businesses and individuals alike.
Questions? Let us know if there is anything we can help you with. Our emergency response team is available 24/7 if you're currently dealing with a cyber attack. Contact us today.
Why Mobile App Vulnerabilities are Dangerous for a Business
Ninety-nine percent of the business workforce currently uses mobile devices to perform their jobs, this according to the IBM-sponsored 2016 Mobile Security & Business Transformation Study.
While this reliance on mobile devices brings enhanced productivity and other business benefits, it also comes with a greater number of security risks.
According to Statista, there were 1.86 billion smartphone users worldwide in 2015. This number is expected to grow to 2.32 billion in 2017. In the smartphone operating system (OS) market, Gartner reported that the battle is clearly between Android (an OS developed by Google) and iOS (an OS developed by Apple). For the first quarter of 2017, Gartner reported that 86.1% of the smartphones sold worldwide runs on Android, 13.7% runs on iOS, and 0.2% runs on other OS.
The Malicious Apps Issue
One of the security risks of using a mobile device at work is the malicious app. There’s an app – short for application program – for almost everything today. As of March 2017, according to Statista, 2.8 million apps can be downloaded from Google Play and 2.2 million apps from Apple App Store.
While Google and Apple have strong security measures in preventing malicious apps from being part of their app stores, some of these malicious apps still slip right through the security nets of these app stores. In the first quarter of 2017, security firm G DATA discovered over 750,000 malicious apps in Android mobile devices.
McAfee in its 2016 Mobile Threat Report said that in 2015, thousands of apps were pulled out from both Google Play and the Apple App Store for security reasons. “Both Google and Apple have been very quick to remove malicious apps from their associated app stores, however it’s inevitable that some infected apps will still slip through the screening process,” McAfee said.
Business risks after your phone is hacked
Once your phone is hacked, your business data is at risk of being exploited by cyber criminals. Here are 2 ways that put business data at risk after your phone is hacked:
1. Ransomware Attack
Ransomware – a type of software that’s programmed to block users until a sum of money is paid – is often associated with PCs. The reality is ransomware isn’t just a PC problem anymore.
In January 2017, security firm Check Point discovered the ransomware called “Charger”. This ransomware was hidden inside an app called EnergyRescue – a malicious app that was briefly available on Google Play and attacked Android devices before being pulled. The Charger ransomware demanded 0.2 Bitcoins (worth $180) from the affected mobile device users and warned that personal information would be sold on the black market if the ransom was not paid.
The ransomware locks the mobile device and displays the following message:
“You need to pay for us, otherwise we will sell portion of your personal information on black market every 30 minutes. WE GIVE 100% GUARANTEE THAT ALL FILES WILL RESTORE AFTER WE RECEIVE PAYMENT. WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER! TURNING OFF YOUR PHONE IS MEANINGLESS, ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS! WE STILL CAN SELLING IT FOR SPAM, FAKE, BANK CRIME etc… We collect and download all of your personal data. All information about your social networks, Bank accounts, Credit Cards. We collect all data about your friends and family.”
The Charger ransomware demonstrates how a malicious app can be a dangerous threat to your business.
2. Danger of Dead Apps
A dead app is an application that’s removed from the app store, without notice. It also refers to an application that’s abandoned by the developer, also without notice. Like other defective products, applications that are removed from the app stores and those abandoned by developers need recall notices.
McAfee identified over 4,000 apps that were removed in 2015 from Google Play without notification to users. McAfee’s 2016 Mobile Threat Report revealed that 500,000 mobile devices still have these dead apps installed and are active. “These users, and the organizations they work for, are still exposed to any vulnerabilities, privacy risks, or malware contained in these dead apps,” McAfee said.
Malicious Apps Prevention
Here are some of the ways to keep your business mobile device safe from malicious apps:
1. Pay close attention to the apps that you’re downloading.
A 3.5 rating for an app on Google Play or Apple App Store isn’t enough in evaluating an app. For instance, sometime before Google Play pulled from its app store, EnergyRescue app – hidden with it was the Charger ransomware – had a 3.6 review rate from 11,584 users. Before downloading an app from known app store such as Google Play and Apple App Store, conduct thorough research about the app developer first.
2. Delete apps that are no longer on the app store.
Apps that are deleted on any app store are vulnerable to cyber criminals as they may have been removed from the app for security reasons or the developer abandoned the app, leaving it without patches or security updates.
To keep the data in your business mobile phone secure and private, it’s a good practice to keep your mobile operating system and the apps up to date. Most of the malicious apps can be blocked by simply updating your mobile operating system. Legitimate app developers also issue patches or security updates.
Skycure’s Mobile Threat Intelligence Report for the 4th Quarter of 2016 showed that the majority of malicious app exploits relies on the existence of unpatched vulnerabilities in the mobile operating systems to be successful. In analyzing the adoption of Android security patches among the five leading wireless carriers in the United States, Skycure found that 71% of Android mobile devices in the 4th Quarter of 2016 were running on security patches that were at least 2 months old, leaving millions unnecessarily vulnerable to malicious app breach.
“About half of devices in use at the end of 2016 had not received a platform security update in the previous year,” said Google in its 2016 Year in Review report.
Pro tip: Administrators, restrict employee access to freely download apps without evaluation and IT approval to prevent device infection and a potential data breach.
Steve E. Driz