Unpatched VPN Vulnerabilities: Attackers’ New Gateway to Gain Access to Victims’ Networks

A new report showed that ransomware attackers are using unpatched VPN vulnerabilities to gain access to victims’ networks.

Fortinet VPN Vulnerabilities

In the report “Vulnerability in FortiGate VPN servers is exploited in Cring ransomware attacks,” researchers at Kaspersky Lab found that the group behind the ransomware called “Cring” gained access to victims’ networks by exploiting CVE-2018-13379 – a known security vulnerability in Fortinet FortiOS under SSL VPN web portal that allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

According to researchers at Kaspersky Lab, CVE-2018-13379 vulnerability was used to extract the session file of the VPN Gateway. The session file contains valuable information, such as the username and plaintext password, the researchers said.

Researchers at Kaspersky Lab added that several days prior to the start of the main attack phase, the attackers performed test connections to the VPN Gateway. The attackers may have identified the vulnerable device themselves by scanning IP addresses, the researchers said, alternatively, they may have bought a ready-made list containing IP addresses of vulnerable Fortinet VPN Gateway devices as an offer to buy a database of vulnerable Fortinet VPN Gateway devices appeared on a dark web forum in autumn of 2020.

In a joint advisory "APT Actors Exploit Vulnerabilities to Gain Initial Access for Future Attacks," the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) reported that in March 2021 they observed threat actors scanning the internet for Fortinet VPN Gateway devices that didn’t apply the security patches to security vulnerabilities CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591. Fortinet, for its part, had issued a security patch for each of the said three security vulnerabilities.

CVE-2020-12812 is a security vulnerability in Fortinet VPN devices that can allow threat actors to log in successfully without being prompted for the second factor of authentication if they changed the case of their username. CVE-2019-5591, meanwhile, is a security vulnerability in Fortinet VPN Gateway devices that can allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.

“The APT actors may be using any or all of these CVEs to gain access to networks across multiple critical infrastructure sectors to gain access to key networks as pre-positioning for follow-on data exfiltration or data encryption attacks,” FBI and CISA said.

Cring Ransomware

Cring ransomware was first observed and reported by security researcher Amigo_A and Swisscom’s CSIRT in late January of this year.

Typical of ransomware, Cring encrypts victims’ files and demands from victims to pay a certain amount (payable in bitcoin) in exchange for the decryption keys that would unlock the encrypted files.

Swisscom’s CSIRT and Kaspersky Lab reported that in the case of Cring ransomware attacks, after the attackers gained access to victims’ networks, they dropped into the victims’ networks customized Mimikatz and followed by CobaltStrike. Mimikatz is an open-source software that allows users to view and save authentication credentials.

CobaltStrike, meanwhile, refers to commercial penetration testing toolkits usually used by security researchers. Malicious software (malware) developers, meanwhile, have cracked and abused CobaltStrike for malicious purposes.

According to researchers at Kaspersky Lab, after Cring ransomware attackers gained access into the victim’s network by exploiting CVE-2018-13379, the attackers then dropped Mimikatz into the compromised system. The researchers said Mimikatz was used to steal the account credentials of Windows users who had previously logged in to the compromised system. With the help of Mimikatz, the attackers were able to compromise the domain administrator account.

After compromising the domain administrator account, the researchers said, Cring ransomware attackers distributed malware to other systems on the organization’s network through the use of Cobalt Strike. The Cobalt Strike Beacon backdoor, researchers at Kaspersky Lab said, provided the attackers with remote control of the infected system.

Cybersecurity Best Practices

Here are some of the best practices in order to prevent Cring ransomware attacks and ransomware attacks in general:

Keep all software up to date

The group behind Cring ransomware exploited the fact that despite the availability of a security patch for CVE-2018-13379, many users have delayed the application of this security patch. If your organization has delayed the application of the security patch for CVE-2018-13379, assume that your organization’s network has already been compromised.

Implement the principle of least privilege

Change the active directory policy in line with the principle of least privilege – a security best practice that requires limiting privileges to the minimum necessary to perform a job. An active directory policy that’s in line with the principle of least privilege only allows users to log in only to those systems needed to perform a function.

Practice Network Segmentation

Network segmentation refers to the practice of subdividing your organization’s network into sub-networks so that in case one sub-network is compromised, the other sub-networks won’t be affected. Restrict VPN access between sub-networks.

Canadian Centre for Cyber Security Warns About the Continued Exploitation of Multiple Vulnerabilities 

The Government of Canada, through the Canadian Centre for Cyber Security, has warned that threat actors are exploiting multiple known vulnerabilities present in information systems in Canada.

According to the Canadian Centre for Cyber Security (Cyber Centre), as information systems and the networks linking them are critical components in today’s interconnected world and relied upon by governments, small businesses and individuals worldwide, the need to secure them is of utmost importance. The Cyber Centre’s warning is similar to the U.S. Government’s warning, through the National Security Agency (NSA), that threat actors are targeting U.S. information systems such as unpatched remote access services, security appliances and application servers.

"The Cyber Centre continues to receive reports of persistent exploitation of known vulnerabilities," the Cyber Centre said. “While manufacturers work hard to provide updates for vulnerabilities, these updates are not always applied in a timely manner by consumers.”

Target Vulnerabilities

Among the vulnerabilities that are being actively exploited by threat actors according to the Cyber Centre and NSA are the following:

This vulnerability, designated as CVE-2020-1472 and commonly known as ZeroLogon, is described by Microsoft as an elevation of privilege vulnerability that exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller using the Netlogon Remote Protocol (MS-NRPC) – Microsoft Windows’ core authentication component of Active Directory that provides authentication for user and computer accounts.

“By simply sending a number of Netlogon messages in which various fields are filled with zeroes, an attacker can change the computer password of the domain controller that is stored in the AD [Active Directory],” Tom Tervoort, Senior Security Specialist at Secura and the one who discovered the Netlogon vulnerability, said in the whitepaper “ZeroLogon: Unauthenticated domain controller compromise by subverting Netlogon cryptography (CVE-2020-1472).” “It basically allows any attacker on the local network (such as a malicious insider or someone who simply plugged in a device to an on-premise network port) to completely compromise the Windows domain.”

ADC is described by Citrix as a networking appliance whose function is to “improve the performance, security and resiliency of applications delivered over the web.” Designated as CVE-2019-19781, this security vulnerability in Citrix ADC, if exploited, could allow an unauthenticated attacker to perform remote code execution – the ability of an attacker to access or make changes to another computer, regardless of where the attacker’s computer is geographically located.

In July of this year, the Canadian Centre for Cyber Security reported that several computer networks in Canada were compromised and, in each case, a threat actor was able to compromise infrastructure exposed to the internet because the software running on an exposed server wasn’t patched to the latest version or properly secured via two-factor authentication. According to the Cyber Centre, prior to the successful compromise of vulnerable and improperly secured servers and network access devices, intensive reconnaissance-style scanning of target networks is often conducted by malicious actors. In some cases, malicious software (malware) was installed and compromised infrastructure may have been used in attempts to compromise other networks and/or other organizations.

Cybersecurity Best Practices

While it’s important to keep all software and firmware up to date, this alone isn’t the whole solution in keeping your organization safe from attackers.

Rare Cases of Multiple Patches

Microsoft is addressing the CVE-2020-1472 vulnerability via a two-part patch rollout. The first patch was released on August 11, 2020 and the last patch will be released in the first quarter of 2021.

What should be done before the arrival of the second part of the patch? Aside from applying the August 11th patch, according to Microsoft, the following steps should be taken:

1. (a) Monitor for warning events and (b) act on each event.
2. (a) Once all warning events have been addressed, full protection can be enabled by deploying DC enforcement mode. (b) All warnings should be resolved before the February 9, 2021 enforcement phase update.

False Sense of Security

It’s important to note that patching alone doesn’t fix a successful network compromise conducted via vulnerability exploitation. For instance, applying the patch for CVE-2019-19781 vulnerability, released by Citrix in January 2020, isn’t enough to fix a network compromised via CVE-2019-19781 exploitation.

In July 2020, Fox-IT reported that back in January 2020, just a few days after the release of the CVE-2019-19781 patch, a total of 1,030 compromised servers were identified, including those owned by Governmental organizations and Fortune 500 companies.

“However, of perhaps more concern was that, of these compromised devices, 54% had been patched against CVE-2019-19781, thus providing their administrators with a false sense of security,” Fox-IT said. “This is because although the devices were indeed patched, any backdoor installed by an attacker prior to this would not have been removed by simply installing the vendor’s patch.”

CVE-2019-19781 also showcased how attackers compete to remain in the networks that they’ve compromised, also known as "hacker turf war." Some threat actors applied the CVE-2019-19781 patch themselves to block other threat actors in what is known as “adversary patching.”

If for some reason your organization has failed to apply a critical patch in a timely manner, expect that credentials, accounts and software have been changed prior to the application of the patch and expect that patching won't alleviate the situation.

When Patching Isn’t Enough

While patching is one of cybersecurity’s best practices, in some cases, this best practice isn’t enough to protect your organization’s network. Such is the case of patching your organization’s Pulse Secure VPN product.

Pulse Secure VPN Patch

On April 24, 2019, VPN vendor Pulse Secure released software updates, also known as patches, addressing multiple security vulnerabilities, including a patch for the security vulnerability designated as CVE-2019-11510. This security vulnerability allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI to perform an arbitrary file reading vulnerability.

Because of the CVE-2019-11510 vulnerability, an attacker will then be able to view files, such as plain text cache of credentials of past VPN users. Armed with stolen credentials, an attacker can pretend to be a legitimate Pulse Secure VPN user. The following are the affected Pulse Secure VPN versions:

• Pulse Connect Secure 9.0R1 - 9.0R3.3
• Pulse Connect Secure 8.3R1 - 8.3R7
• Pulse Connect Secure 8.2R1 - 8.2R12
• Pulse Connect Secure 8.1R1 - 8.1R15
• Pulse Policy Secure 9.0R1 - 9.0R3.1
• Pulse Policy Secure 5.4R1 - 5.4R7
• Pulse Policy Secure 5.3R1 - 5.3R12
• Pulse Policy Secure 5.2R1 - 5.2R12
• Pulse Policy Secure 5.1R1 - 5.1R15

Following the release of Pulse Secure security updates, Cyber Security Centers in several countries, including Canada, US and Japan have issued alerts calling local organizations to apply in a timely manner the security updates released by Pulse Secure, including the patch for CVE-2019-11510.

Post Pulse Secure VPN Patching Exploitation

The United States’ Cybersecurity and Infrastructure Security Agency (CISA) recently issued a follow-up alert, warning organizations that those that applied the April 24, 2019 Pulse Secure VPN update could still face continued threat actor exploitation post Pulse Secure VPN patching. According to CISA, as the security vulnerability CVE-2019-11510 allows attackers to steal victim organizations’ credentials, failing to change those stolen credentials allows an attacker to move laterally through the organization’s network even after the organization has patched this vulnerability.

CISA reported it observed threat actors used connection proxies, such as Tor infrastructure and virtual private servers (VPSs), to lessen the chance of detection when they connected to victims’ networks via Pulse Secure VPN. The US Cybersecurity Agency found that once inside the victims’ networks, threat actors conducted the following malicious activities:

• Creating persistence via scheduled tasks/remote access trojans
• Amassing files for exfiltration
• Executing ransomware on the victim’s network environment

CISA added that, in one case, it observed a malicious actor attempting to sell the stolen Pulse Secure VPN credentials after 30 unsuccessful attempts to connect to a victim’s network to escalate privileges and drop ransomware. CISA also noted that this same malicious actor successfully dropped ransomware at hospitals and U.S. Government entities.

CISA further reported that malicious actors that leveraged stolen Pulse Secure VPN credentials used tools such as LogMeIn and TeamViewer. LogMeIn is a software that allows users to remotely access another computer. TeamViewer, meanwhile, is an all-in-one solution for remote support, remote access and online meetings. According to CISA, LogMeIn and TeamViewer enable malicious actors to maintain access to the victim’s network environment if they lost their primary connection, that is, via VPN access.

Preventive and Mitigating Measures Against Post Pulse Secure VPN Patching Exploitation

As many organizations encourage employees to work from home as a result of the current COVID-19 crisis, the use of VPN products has been increasing. It’s important to secure this communication line between remote workers and your organization.

Patching, from the word “patch”, is a set of changes to the source code of a software program for the purpose of fixing a known security vulnerability or to improve it.

While patching is still one of the top cybersecurity best practices, this practice alone isn’t enough especially when the exploited security vulnerability involves stolen authentication credentials. According to the US Cybersecurity Agency, organizations that have applied patches for CVE-2019-11510 may still be at risk for exploitation from compromises that occurred pre-patch.

Below are the suggested detection methods by the US Cybersecurity Agency to find out if your organization had been targeted before applying the Pulse Secure VPN patch.

• Turn on unauthenticated log requests.
• Check logs for exploit attempts. To detect exploit attempts, look in the logs for strings such as ../../../data.
• Manually review logs for unauthorized sessions, in particular, sessions originating from unexpected geo-locations.
• Run CISA’s detection tool – a tool that’s available on CISA’s GitHub page. This tool allows system administrators to triage logs (provided authenticated request logging is turned on) and automatically search for CVE-2019-11510 exploitation.

The following are the additional suggested mitigating measures against post Pulse Secure VPN patching exploitation:

• Look for software programs installed without authorization.
• Remove software programs, especially those that allow remote access not approved by your organization.
• Remove any remote access trojans – malicious software that disguised as legitimate software.
• Check scheduled tasks for scripts or executables that could allow an attacker to connect to your organization’s work stations or servers.

“If organizations find evidence of malicious, suspicious, or anomalous activity or files, they should consider reimaging the workstation or server and redeploying back into the environment,” the US Cybersecurity Agency said.

Decade-Old Vulnerability Found in Avaya VoIP Phones

Researchers at McAfee Advanced Threat Research have discovered a decade-old security vulnerability lurking in the Voice over Internet Protocol (VoIP) phones of Avaya, the world’s second largest VOIP phone provider.

The decade-old vulnerability present in Avaya VOIP phones, specifically 9600 Series, J100 Series and B189 Series using the H.323 firmware, according to researchers at McAfee Advanced Threat Researchallows remote code execution (RCE) – enabling an attacker to access someone else's device and make changes to it, regardless of where this device is geographically located.

The RCE vulnerability in a piece of open-source software that Avaya used, the researchers said, was likely copied and modified 10 years ago and the company failed to apply subsequent security patches. The researchers added that a malicious actor exploiting the said vulnerability could take over the normal operation of the phone, copy audio from speakerphone and “bug” the phone.

The piece of open-source software that Avaya copied bore the 2004-2007 copyright, which according to the researchers is a “big red flag” as this piece of software has an exploit that has been publicly available since 2009. The 2009 exploit demonstrated that devices using DHCP client version 4.1 and below allows remote DHCP servers to execute arbitrary code. A DHCP client, also known as dhclient, is a device that needs an IP address; while DHCP server hands out an IP address to the dhclient.

Researchers at McAfee Advanced Threat Research found that Avaya VOIP phone’s version of dhclient is vulnerable to the exploit reported in 2009. The researchers said that malicious actors could build a “weaponized version” of the exploit and threaten private networks.

The researchers reported their discovery to Avaya. In June this year, Avayaissued a patch for the affected VOIP phones.

VOIP Phones as Path to Intrusion

Early this month, researchers at Microsoft Threat Intelligence Center reported that VoIP phone is one of the devices being used by a known cyber adversary to gain initial access to corporate networks. Aside from VoIP phone, the researchers said, popular office IoT devices printer and video decoder, are also being used by this known cyber adversary in gaining an initial foothold into corporate networks.

Researchers at Microsoft Threat Intelligence Center, however, didn’t specify the brands of VOIP phone, office printer and video decoder. These office devices, according to the researchers, were compromised either as these devices were deployed without changing the default manufacturer’s login details or the latest security update hadn’t been applied.

According to Microsoft Threat Intelligence Center researchers, the known cyber adversary used these 3 popular office IoT devices as points of ingress in gaining initial foothold to a corporate network. Once inside a corporate network via these compromised IoT devices, the attacker was seen conducting a simple network scan to look for other vulnerable devices.

As the attacker moved from one vulnerable device to another, a simple shell script was dropped to establish persistence on the network. This simple shell script allowed the attacker to search for higher-privileged accounts that would grant access to higher-value data, the researchers at Microsoft Threat Intelligence Center found.

Botnets

Aside from using popular office IoT devices as points of ingress in accessing high-value data, these compromised devices are also used to build a botnet – referring to a group of devices infected with a malicious software (malware) and controlled by an attacker or attackers for malicious activities, including distributed denial-of-service (DDoS) attacks. In a DDoS attack, a botnet or group of infected devices is controlled to direct their traffic to a target, overwhelming this target with too much traffic that the target can’t handle, ultimately bringing the target offline and rendering the target inaccessible to its legitimate customers.

VPNFilter is an example of a botnet. At its peak, VPNFilter infected at least 500,000 networking devices in at least 54 countries. The following are devices affected by VPNFilter: Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices.

According to researchers at Cisco, VPNFilter has a self-destruct capability that can be triggered en masse via the botnet structure and has the potential of cutting off internet access for hundreds of thousands of users worldwide. The researchers are unsure why so many devices were infected with VPNFilter. Most of the infected devices, however, have known public exploits or default manufacturer’s login details hadn’t been changed.

In May 2018, the potential negative effect of VPNFilter was mitigated when the U.S. Federal Bureau of Investigation (FBI)seized a domain used as command and control (C2) by the threat group in their botnet campaign. In a botnet operation, C2 (could be a website or a public cloud account) is used to communicate or control the infected devices.

The devastating effect of a botnet was shown to the world when the Mirai botnet attacked in 2016 Dyn, a major dynamic DNS provider, resulting in the widespread internet outages across the U.S. and Europe. The earlier versions of the Mirai, including the one that attacked Dyn, infected hundreds of thousands of wireless cameras and routers and turned them as botnets. Since the publication of the source code of the Mirai in 2016, a number of Mirai versions has been observed in the wild.

Researchers at Palo Alto Networks discovered a different version of the Mirai which targeted WePresent WiPG-1000 Wireless Presentation systems and LG Supersign TVs – IoT devices that are often used by businesses. Many of the Mirai variants infect IoT devices by exploiting the practice of users of not changing the default manufacturer’s login details.

Prevention

Today’s IoT devices outnumber the combined number of personal computers and mobile phones. Hundreds of thousands, if not, millions of these IoT devices are, however, left without basic management.

Changing the default manufacturer’s login details and applying the latest security update are two cyber security best practices in preventing malicious actors from accessing your organization’s network. These practices also stop your organization’s IoT devices from being used as part a botnet for malicious activities such as DDoS attacks.

Why Organizations Need To Secure Microsoft Office Settings

The latest discovery of a flaw in Microsoft Excel by researchers at Mimecast shows the importance of securing your organization’s Microsoft Office settings.

Researchers at recently released a proof of concept demonstrating that a flaw in Microsoft Excel could allow a malicious actor to access someone else's computer and launch a cyber-attack, no matter where this computer is located. Mimecast researchers said that Power Query, a feature in Excel that lets users integrate their spreadsheets with other data sources, such as an external database or a web page, could allow attackers to “embed malicious content in a separate data source, and then load the content into the spreadsheet when it is opened”. Mimecast researchers added, “The malicious code could be used to drop and execute malware that can compromise the user’s machine.”

According to Mimecast researchers, Power Query is a powerful tool within Microsoft Excel that if exploited, can be used to launch . In a DDE attack, a malicious actor exploits DDE – a protocol in Windows which was first introduced in 1987 and currently used by thousands of applications such as Microsoft Excel. 

The researchers added that attacks that exploit Power Query are hard to detect by anti-virus or anti-malware security solutions. “Using the potential weakness in Power Query, attackers could potentially embed any malicious payload that as designed won’t be saved inside the document itself but downloaded from the web when the document is opened,” the researchers said.

Dynamic Data Exchange (DDE) Attacks

Researchers have known about DDE vulnerabilitysince 2014, finding that “by specifying some creative arguments and a magic number, it’s possible to craft a ‘link’ that hijacks the computer of whoever opens the document”.

In May 2016, researchers at SensePostdemonstrated that DDE attack can be done in Microsoft Excel. In October 2017, researchers at SensePost demonstrated that DDE attack can be done in Microsoft Word.

In November 2017, reported that the threat Group known as “APT28” slipped a malware into a malicious Word document with a subject heading that cites of a then-recent terrorist attack in New York City. McAfee said this Word document leveraged the Microsoft Office Dynamic Data Exchange (DDE) attack technique.

According to McAfee, the malicious Word document itself is blank and once the document is opened, the document contacts a control server that drops the malware called “Seduploader” onto a victim’s computer. Seduploader is a first-stage malware deployed for the purpose of conducting reconnaissance on a network before dropping a second-stage malware.

To successfully launch a DDE attack, McAfee said, an attacker only needs to convince a user to click through a few dialogs, which would evade the latest macro-based document mitigations. “DDE can be used to launch scripts and executables from the command line by inserting the DDE field in the Office document,” McAfee said.

In an email attack scenario, Microsoft, for its part, said that an attacker could exploit the DDE protocol by sending a specially crafted attached file to the user and then convincing the user to open the attached file. “The attacker would have to convince the user to disable Protected Mode and click through one or more additional prompts,” Microsoft said.

How to Mitigate Microsoft Office Settings Risk

Microsoft, in a statement to Threatpost, said that the proof of concept of the Mimecast researchers was reviewed but in order for the concept to work, a victim “would need to be socially engineered to bypass multiple security prompts prior to loading external data or executing a command from a DDE formula”. Because of this finding, Microsoft didn’t release a patch for this security vulnerability.

Microsoft issued the following mitigating measures in order to protect your organization from DDE attacks:

1. Keep Your Microsoft Office Up-to-Date

The December 12, 2017 security updatein Microsoft’s Office disables the Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word.

2. Disable DDE Protocol in Microsoft Excel

Microsoft, however, hasn’t disabled DDE in Microsoft Excel. In the security advisory "Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields", Microsoft noted that Excel, in particular, depends on the DDE feature to launch documents. "Disabling this feature could prevent Excel spreadsheets from updating dynamically if disabled in the registry,” Microsoft said. “Data might not be completely up-to-date because it is no longer being updated automatically via live feed. To update the worksheet, the user must start the feed manually. In addition, the user will not receive prompts to remind them to manually update the worksheet.”

As early as 2007, Raymond Chen, who has been involved in the evolution of Windowsfor decades, said that "there is no technological reason for you to use DDE”. Chen, however, said that even if there’s no technological reason for you to use DDE, “you still have to be mindful of whether your actions will interfere with other people who choose to”.

3. Exercise Caution When Opening Suspicious File Attachments

As email attachments are a primary method by DDE attackers to spread malware, Microsoft recommends that users exercise caution when opening suspicious file attachments.

Microsoft Windows Privilege Escalation Vulnerability Leaked via Twitter

A security researcher who goes by the name “SandboxEscaper” leaked via Twitter an exploit code for a Microsoft Windows privilege escalation vulnerability.

In the now-deleted Twitter post, SandboxEscaper provided a link to a Github repository that contains the code necessary to exploit a Microsoft Windows privilege escalation vulnerability. Other security researchers have since verified the authenticity of the vulnerability exploit disclosed by SandboxEscaper.

The bug uncovered by SandboxEscaper lies in Microsoft Windows task scheduler service. Task scheduler allows users to schedule any program to run at a convenient time or when a specific event occurs. 

SandboxEscaper found that task scheduler uses unsecured API that allows an attacker, having access to a computer as a local user to gain system-level privileges, enabling the attacker to overwrite system files with malicious code to hijack Windows.

“The Microsoft Windows task scheduler SchRpcSetSecurity API contains a vulnerability in the handling of ALPC, which can allow an authenticated user to overwrite the contents of a file that should be protected by filesystem ACLs,” CERT Coordination Center (CERT/CC)described the uncovered flaw. “This can be leveraged to gain SYSTEM privileges.”

“The flaw is that the Task Scheduler API function SchRpcSetSecurity fails to check permissions,” security researcher Kevin Beaumont, for his part, noted. “So anybody  –  even a guest  –  can call it and set file permissions on anything locally.”

As a proof-of-concept, SandboxEscaper overwrites a file used by Windows' printing subsystem with a malicious code when an attempt is made to print.

According to CERT/CC, the exploit code leaked by SandboxEscaper works on 64-bit Windows 10, Windows Server 2016 systems, 32-bit Windows 10 with minor modifications and with other Windows versions with further modifications. CERT/CC said it’s currently unaware of a practical solution to this problem.

A Microsoft spokesperson told the Registerthat the company will “proactively update impacted devices as soon as possible.”

In another Twitter post, SandboxEscaper blamed depression for leaking the vulnerability exploit before Microsoft has time to issue a security update or a patch.

Exploits for privilege escalation vulnerabilities are rarely leaked to the public prior to a patch as many software vendors like Microsoft now offer financial rewards to security researchers who uncover and discreetly inform the concerned software vendors. This gives security vendors time to create a security fix to the reported problem.

Dangers of Privilege Escalation Attacks

In a privilege escalation attack, the attacker has to have local access to the computer or computer network that he or she wants to compromise. A local user needs the system administrator's password to complete certain tasks, such as overwriting system files. As such, this is given less priority by software vendors when it comes to patching.

Remote code execution attacks, on the other hand, are given high priority in terms of patching as these attacks don’t require that the attacker have local access to the target computer.

In a remote code execution attack, an attacker can install malicious code on a computer even when he or she has no local access, provided though that the computer is connected to the internet. An example of the remote code execution attack was the WannaCry attack. Hours after the WannaCry attack on May 12, 2017, Microsoft issued a security update for Windows platforms originally not covered by an earlier security patch, showing the importance of patching remote code execution attacks.

Privilege escalation attacks, however, aren’t given similar immediate attention. Privilege escalation vulnerabilities are typically patched during scheduled updates, like Microsoft’s regular security updates every second Tuesday of each month.

Client-side exploits, however, make privilege escalation attacks dangerous as attackers then effectively become local users and escalate their privileges to system administrators.

"If an attacker can gain access to a system through a client side exploit, they may then effectively become the local user, and escalate to local system,” SANS Technology Instituteinstructor Adrien de Beaupre wrote in a post "Privilege escalation, why should I care?" “Local system priv on a Windows computer is just a hop, skip, and jump away from being Domain administrator.”

Client-side exploits come in numerous and varied formats. Compared to remote execution attack like the WannaCry that has worm capability – meaning, it replicates itself without user interaction, client-side exploits need user interaction, such as clicking a malicious link or downloading a malicious email attachment.

Prevention

The fact that the exploit code is out and there’s no official patch from the software vendor should warrant some caution. However, unofficial patch has been posted by 0Patch.com

“Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible,” a Microsoft spokesperson told Threatpost. “Our standard policy is to provide solutions via our current Update Tuesday schedule.”

That means that the next Windows update is still days away – this coming September 11^th. This gives attackers a window to exploit the flaw exposed by SandboxEscaper in the wild.

According to Kevin Beaumont, if you use Microsoft Sysmon, a sure way to find out whether a Microsoft Windows task scheduler exploit is being used is by looking for spoolsv.exe spawning abnormal processes.

Here are some general measures in preventing privilege escalation attacks like the one exposed by SandboxEscaper:

• Install software updates as soon as they’re made available.
• Use anti-virus protection.
• Educate staff about the dangers of clicking links and downloading email attachments from unknown sources.
• Practice network segmentation so that if one network is compromised the other network won’t be affected.
• Don’t allow untrusted users to install code.

Critical Security Flaw Meltdown and Spectre Explained

Meltdown and Spectre are critical security vulnerabilities that affect most modern computer processors and operating systems. These vulnerabilities allow computer programs to steal sensitive data processed on the computer.

Meltdown’s official name is CVE-2017-5754. Spectre is the collective name for 2 vulnerabilities, CVE-2017-5753 and CVE-2017-5715. CVE stands for common vulnerabilities and exposures. It’s a system that provides official references for publicly known cybersecurity vulnerabilities.

A typical computer program isn’t allowed to read data from other computer programs. What Meltdown and Spectre do is access the data stored in the memory of other running computer programs. Data that could be accessed by these vulnerabilities include photos, instant messages, emails and passwords stored in a browser or password manager.

What is Meltdown?

What Meltdown does is break the barrier that isolates computer programs and the operating system. By breaking this barrier, a Meltdown attack could access the operating system and other programs.

Meltdown was independently discovered by security researchers from Google Project Zero, Cyberus Technology and Graz University of Technology.

According to the security researchers who discovered Meltdown, this vulnerability potentially affects every Intel processor which implements “out-of-order execution” meaning, every Intel processor produced since 1995, except Intel Itanium and Intel Atom before 2013. Meltdown has also been shown to potentially affect other processors including ARM and AMD.

Cloud providers which use Intel CPUs and Xen PV and cloud providers without real hardware virtualization may also be potentially affected.

What is Spectre?

What Spectre does is break the barrier that isolates different computer programs. It also tricks a computer program that follows security practices into leaking data.

Spectre was independently discovered by Jann Horn of Google Project Zero and

Paul Kocher.

According to the security researchers who discovered Spectre, almost every modern desktops, laptops, mobile devices and cloud servers are potentially vulnerable. In particular, Intel, AMD and ARM processors are known to be potentially vulnerable to Spectre.

Similarities Between Meltdown and Spectre

Here are the similarities between Meltdown and Spectre:

• Both affect most modern computer chips and operating systems.
• Both could steal sensitive data processed on the computer.
• Both are difficult to detect.

It’s difficult to detect these vulnerabilities as they don’t leave any traces in traditional log files. They’re also difficult to detect as antivirus, for instance, find it hard to distinguish an error-free computer program from Meltdown or Spectre.

Difference Between Meltdown and Spectre

The difference between Meltdown and Spectre is that while Meltdown cracks the barrier that prevents programs from accessing the computer memory, Spectre tricks other computer programs into accessing arbitrary locations in their memory.

Researchers who discovered Meltdown and Spectre said they don’t know whether these vulnerabilities have been exploited into the wild. ProjectZero team at Googlepublicly disclosed these vulnerabilities on January 3, 2018. The team reported these security issues to Intel, AMD and ARM on June 1, 2017.

Intel’s January 2018 press statementstates that the company will issue security updates for at least 90% of Intel CPUs introduced in the last 5 years by January 15, 2018, while security updates for the remaining CPUs will be available by the end of January.

In Intel’s latest press statement, the company said it won’t issue security updates for Spectre for the following processors: Bloomfield line, Clarksfield, Gulftown, Harpertown line, Jasper Forest, Penryn/QC, SoFIA 3GR, Wolfdale line and Yorkfield Line.

Here’s Intel’s explanation why it won't issue security updates of the above-mentioned chips:

“After a comprehensive investigation of the microarchitectures and microcode capabilities for these products, Intel has determined to not release

microcode updates for these products for one or more reasons including, but not limited to the following:

• Micro-architectural characteristics that preclude a practical implementation of features mitigating Variant 2 (CVE-2017-5715)
• Limited Commercially Available System Software support
• Based on customer inputs, most of these products are implemented as ‘closed systems’ and therefore are expected to have a lower likelihood of exposure to these vulnerabilities.”

Most of the above-mentioned unsupported Intel processors are more than 5 years old, some even are more than a decade old, with exception of SoFIA 3GR which was released only in 2015.

According to Microsoft, it has released several security updates to mitigate the effects of Meltdown and Spectre. The company added that it took action to protect its cloud services against these vulnerabilities. “Microsoft has released several updates to help mitigate these vulnerabilities,” Microsoft said in a statement. “We have also taken action to secure our cloud services."

How to Protect Your Organization’s Computers from Meltdown and Spectre

Here are some of the preventive measures to protect your organization’s computers from these vulnerabilities:

• Install security updates.

Meltdown and Spectre affect a number of computer processors, not just Intel. These vulnerabilities also affect operating systems, not just Windows. According to Microsoft, users of Windows operating systems should apply the January and February 2018 Windows security updates as well as the monthly Windows security updates.

• For Windows server operating system, Microsoft recommends making necessary configuration changes to enable protection.

• Avoid unrecognized hyperlinks and websites.

• Avoid downloading files or applications from unknown sources.

• Follow secure password protocols.

• Use security software to help protect against malicious software (malware).

• Consider CPU Options

According to Carnegie Mellon University Software Engineering Institute, there have been reports that the overall CPU performance is impacted by many of the available patches for these vulnerabilities. 

“While we recognize that replacing existing CPUs in already deployed systems is not practical, organizations acquiring new systems should evaluate their CPU selection in light of the expected longevity of this vulnerability in available hardware as well as the performance impacts resulting from the various platform-specific software patches,” Carnegie Mellon University Software Engineering Institute said.

Top 7 Cyber Security Tools for Your Business

With so much of our information online, everyone is vulnerable to hackers and cyber-thieves. When it comes to business, a cyber invasion is a constant threat.

Short term loss could be financial, intellectual property theft, data loss, or worse.

The real threat is the long term loss of trust and reputation damage that could take years to repair. If your clients' information is exposed, it will be hard for them to consider it safe to give you their business again. 

Protect your business with these 7 cyber security tools.

7 Cyber Security Tools Your Business Must Be Using

In order to protect your business' digital information, you need a variety of cyber security tools in place. 

For complete peace of mind, you'll want to work with a trusted cyber security partner. In the mean time, these tools are a great place to start. 

1. Malware Scanners

Malware is short for malicious software. It is designed by hackers to gain access to a computer without the owner's knowledge. 

You must have specific anti-malware cyber security tools in place to detect any hacker invasion. 

There are a variety of malware scanners out there, many even available for free (with limited features). 

Protect your business with automatic malware scanners in place. 

2. Routine Patching

Patching is the process of installing a piece of software that repairs any security flaws. Updating an app is an example of patching. 

Picture your business's digital infrastructure as a house. Each time you add a new application, piece of software, etc. it's like adding a new room to the house. 

Software, apps, and the like are built by humans, meaning that there is room for human error. Human error is like an unlocked door or unfinished window in one of the new rooms. 

This can leave a welcome mat out to cyber attackers. That's why your security plan needs to include routine assessments and patching. 

3. Two-Factor Authentication

Use two-factor authentication to add a difficult-to-hack layer of security to your log in systems.

Examples include a verification code sent to a linked phone number or a piece of information only the user would know. 

4. Restrictive Administrative Access

Add an additional security level for your most sensitive information and infrastructure by restricting who can access it.

Click here for more information on how to implement restrictive admin mode. 

5. Network Segmentation

Divide your computer network into sub networks to improve security and performance.

This allows you to isolate the most sensitive data to a specific network to limit access and decrease congestion. 

6. Vulnerability Scanning

There's no better way to access your security levels than a vulnerability scan. 

Try our free vulnerability assessment to find weaknesses in your code and how to remedy them. 

7. 24/7 Security Monitoring

Cyber security protection doesn't come in the form of a quick fix.

Continually protect your business' data with a 24/7 security monitoring system in place to catch attacks the minute they happen. 

Protect Your Business for Peace of Mind

Cyber security tools are of the utmost importance for businesses and individuals alike.

Questions? Let us know if there is anything we can help you with. Our emergency response team is available 24/7 if you're currently dealing with a cyber attack. Contact us today. 

Why Mobile App Vulnerabilities are Dangerous for a Business

1. Ransomware Attack

2. Danger of Dead Apps