What Is Chaining Attack and How to Prevent This Cyberattack Method

Some of the most widespread and devastating cyberattacks, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), have included multiple vulnerabilities – a cyberattack methodology known as “chaining”.

What Is Chaining?

Chaining is a type of cyberattack that uses a combination of multiple cybersecurity vulnerabilities rated “critical”, “high”, “medium”, or even “low”.

Today’s publicly disclosed cybersecurity vulnerabilities are listed or cataloged under CVE, which stands for Common Vulnerabilities and Exposures. Each cybersecurity vulnerability in the list is given an identification number.

For example, CVE-2021-26855 is the identification number given to a part of an attack chain against Microsoft Exchange Server. This security vulnerability has a “critical” rating under CVSS, which stands for Common Vulnerability Scoring System. 

Although sponsored by the U.S. Department of Homeland Security (DHS) and CISA, CVE is run by the non-profit organization MITRE. The Forum of Incident Response and Security Teams (FIRST) provides a standard for CVSS numerical score and qualitative representation (critical, high, medium, and low) for CVE entries. The National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), meanwhile, provides a free CVSS calculator for CVE entries. 

Real-World Examples of Chaining Attacks

CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 are four security vulnerabilities that are part of an attack chain against Microsoft Exchange Server.

Microsoft describes the four security vulnerabilities this way:

CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM [named given by Microsoft to the group behind this chain attack] the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

In the blog post "HAFNIUM targeting Exchange Servers with 0-day exploits", Microsoft said CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 vulnerabilities were used by the threat actor HAFNIUM to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments. 

According to CISA, attackers don’t rely only on “critical” vulnerabilities to achieve their goals. For instance, some attackers use lower score vulnerabilities to first gain a foothold, then exploit additional vulnerabilities to escalate privilege on an incremental basis.

In the above-mentioned real-world example of chaining attacks, CVE-2021-26855 has a critical CVSS rating, while CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 have a high CVSS rating.

In a chaining attack, threat actors don’t necessarily exploit multiple security vulnerabilities in one application. There are cases in which threat actors exploit vulnerabilities in multiple applications during a single attack.

Mitigating the Risks of Chaining Attacks

The best cybersecurity best practice against chaining attacks is by keeping all software up to date.

Keeping all software up to date, however, is easier said than done. As of November 11, 2021, there are a total of over 160,000 CVE records. Organizations need to properly assess and prioritize which security vulnerabilities should be patched first.

In the study "Historical Analysis of Exploit Availability Timelines", researchers at Carnegie Mellon University found that only 4% of the total number of CVEs have been publicly exploited in the wild. The researchers further found that out of the 4% publicly exploited CVEs, 42% are being used on day 0 of disclosure; 50% within 2 days of disclosure; and 75% within 28 days of disclosure. The CVSS ratings of some of these publicly exploited CVEs have “medium” or even “low” severity ratings.

CISA recently established a “living” catalog of CVEs that are exploited in the wild. The agency calls these publicly exploited CVEs as “Known Exploited Vulnerabilities (KEVs)”. CISA initially listed 182 vulnerabilities from 2017-2020 and 108 from 2021.

CISA said that the CVSS scores or ratings don’t always accurately depict the danger or actual hazard that a CVE presents.

Instead of only focusing on vulnerabilities that carry a specific CVSS rating, KEVs target vulnerabilities for remediation that have known exploits and are being actively exploited by malicious cyber actors. CISA recommends that these KEVs have to be remediated within a more aggressive timeline.

CISA said these are two of the reasons for a more aggressive remediation timeline for KEVs:

1. Cyber criminals and malicious actors were able to scan the internet for known vulnerabilities and exploit them within much smaller time frames; and
2. The adaptability, sophistication, and speed at which cyber adversaries were targeting and exploiting known vulnerabilities outpaced agencies improved remediation time.