Author Archives: Klaus Jochem

Windows malware Sarwent got an upgrade. Thou shalt not work with permanent administrative privileges!

23 May 2020

Catalin Cimpanu (1) reports in his post „Windows malware opens RDP ports on PCs for future remote access“ published on ZDNET that the Windows malware Sarwent got an upgrade: It is now capable of using the windows command line and PowerShell, adding users, and opening ports in the Windows firewall for RDP access from remote. Since the latter features require administrative privileges on the victims machine, it is very likely that the victims worked with permanent administrative privileges.

To mitigate the risk, the best approach is to revoke any administrative privileges from standard users. This will not reduce the likelihood of occurrence, but it will reduce the severity of impact of an infection with Sarwent. Furthermore, since the attacker is forced to download tools to fully compromise the victims computer, the likelihood of detectability is increased.

Revoking administrative privileges from standard users is a low-cost, high-impact means to enhance resiliency against cyber-attacks, thus should be part of each security strategy.

But it is hard to implement. Managers will face lots of discussions if users must give up beloved habits. It is very important to keep the number of exceptions as small as possible because every exception lowers the overall security level of the company.

Have a great weekend.


  1. Cimpanu C. Windows malware opens RDP ports on PCs for future remote access [Internet]. ZDNet. 2020 [zitiert 22. Mai 2020]. Verfügbar unter: https://www.zdnet.com/article/windows-malware-opens-rdp-ports-on-pcs-for-future-remote-access/

Thunderspy – Don‘t panic!

19 May 2020

Björn Ruytenberg‘s (1) publication about 7 vulnerabilities in Intel’s Thunderbolt interface justifiably attracts a lot of media attention. Ruytenberg writes in the summary:

“Thunderspy targets devices with a Thunderbolt port. If your computer has such a port, an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted and your computer is locked or set to sleep.”

In Nazmus Sakib’s (2) post in the Microsoft Security Blog this sounds more dramatically:

“An attacker with physical access to a system can use Thunderspy to read and copy data even from systems that have encryption with password protection enabled.”

For the record: Full Disk Encryption (FDE) like BitLocker or LUKS only protects against theft if the computer is in shutdown or hibernation mode. In these cases, the system asks for the passphrase to encrypt the device. If the computer is booted or in sleep mode full disk encryption is useless.

This also holds for Thunderspy. The facts in brief. Thunderspy is a classic “evil maid DMA” attack. The attacker has to flash the Thunderbolt firmware with malicious code and wait for the victim to boot his computer. Once the computer is left unattended the attacker plugs in a specially crafted Thunderbolt device and copies data from the disk.

This is nothing new. The bad news is that all Thunderbolt-equipped computers built between 2011 and 2020 are affected. And that the vulnerabilities cannot be fixed; a hardware redesign is required.

So, everyone with a Thunderbolt-equipped computer should be concerned? No, absolutely not.

Risk for Consumers
The risk for consumers is unchanged because, in general, these devices are not secured, neither with a BIOS password nor with FDE, thus easy to compromise, e.g., with a Linux Live System, if left unattended.

Risk for Business people
The risk for business people is slightly increased. Business computers in general are secured with FDE, so the attacker must wait until the computer is left unattended to plug in the malicious device. Mitigation in this case requires a change in our habits: Put the computer in hibernation mode, instead in sleep mode, if you leave you workplace. The other important rule, “Don’t attach unknown devices to your computer” is already followed in the business domain.

Risk for Executives
The risk for business executives, military, government officials, etc. is unchanged. This group is always under attack, thus hopefully well protected.

Picture credit: Setreset (1)

Picture credit: Setreset (1)

Dan Goodin (3) sums it up:

“Readers who are left wondering how big a threat Thunderspy poses should remember that the high bar of this attack makes it highly unlikely it will ever be actively used in real-world settings, except, perhaps, for the highest-value targets coveted by secretive spy agencies. Whichever camp has a better case, nothing will change that reality.”

Don’t panic!


References

  1. Ruytenberg B. Thunderspy – When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security [Internet]. Thunderspy. 2020 [zitiert 18. Mai 2020]. Verfügbar unter: https://thunderspy.io/
  2. Sakib N. Secured-core PCs help customers stay ahead of advanced data theft [Internet]. Microsoft Security Blog. 2020 [zitiert 18. Mai 2020]. Verfügbar unter: https://www.microsoft.com/security/blog/2020/05/13/secured-core-pcs-help-customers-stay-ahead-of-advanced-data-theft/
  3. Goodin D. Thunderspy: What it is, why it’s not scary, and what to do about it [Internet]. Ars Technica. 2020 [zitiert 13. Mai 2020]. Verfügbar unter: https://arstechnica.com/information-technology/2020/05/thunderspy-what-is-is-why-its-not-scary-and-what-to-do-about-it/

PIcture credit

  1. Setreset / CC BY-SA (https://creativecommons.org/licenses/by-sa/3.0), https://commons.wikimedia.org/wiki/File:Spy_silhouette.svg

Have you patched these top 10 routinely exploited vulnerabilities?

16 May 2020

On Tuesday, CISA published the alert (AA20-133A) on the „Top 10 Routinely Exploited Vulnerabilities“(1). A day later, Zeljka Zorz raised the absolutely legitimate question „Have you patched these top 10 routinely exploited vulnerabilities?“(2) on HELPNETSECURITY.

A query against the NIST NVD and the Exploit-DB shows a gloomy picture:

Top 10 Exploited Vulnerabilities

Top 10 Exploited Vulnerabilities

For the red highlighted vulnerabilities the exploit was available at the day of publication in the NVD. For the green highlighted vulnerabilities the exploit was published shortly after the vulnerability. So, the question should be:

How fast did you patch these top 10 routinely exploited vulnerabilities?

These are telling examples and they are not isolated:

Exploit Publication Date relative to CVE Publication Date

Exploit Publication Date relative to CVE Publication Date

The data from 2013 – 2019 for critical vulnerabilities show:

  • 41% of exploits were published before or at the same day the CVE was published, and
  • 43% of Exploits were published in the range between 10 days before and 10 days after the CVE.

Time is crucial in cyber space operations. In high risk domains, critical vulnerabilities should be patched at least 24 hours after the patch is available. If a vendor cannot provide a patch in time mitigting measures should be applied, in the worst case, systems must be removed from the internet.

Remind the Equifax case (CVE-2017-5638) from 2017.

Have a good weekend.


References

  1. CISA. Top 10 Routinely Exploited Vulnerabilities [Internet]. National Cyber Awareness System. 2020 [zitiert 16. Mai 2020]. Verfügbar unter: https://www.us-cert.gov/ncas/alerts/aa20-133a

  2. Zorz Z. Have you patched these top 10 routinely exploited vulnerabilities? [Internet]. Help Net Security. 2020 [zitiert 14. Mai 2020]. Verfügbar unter: https://www.helpnetsecurity.com/2020/05/13/routinely-exploited-vulnerabilities/

ZDF: Behörde schlägt Alarm – Sicherheitslücken in Mail-App von Apple. Grund zur Panik?

26. April 2020

Sicherheitslücken in Apps müssen schon gravierend sein, wenn ZDF(1) und DLF(2) darüber berichten. In der Regel basieren solche Berichte auf Warnungen des BSI und sind entsprechend ernst zu nehmen. Das ist auch hier der Fall. In einer Pressemitteilung(3) vom 23.4.2020 warnte das BSI vor Einsatz von iOS-App “Mail”.

Das BSI stützt seine Warnung auf eine Untersuchung des Cyber Security Startups ZecOps, die am 20.4.2020 unter dem Titel „You’ve Got (0-click) Mail!“ im ZecOps Blog(4) veröffentlichte wurde.

Das BSI schätzt die Schwachstellen „besonders kritisch“ ein und empfiehlt das „Löschen der App “Mail” oder Abschaltung der Synchronisation“(3), solange kein Patch verfügbar ist.

In der NIST NVD Schwachstellendatenbank sind noch keine Details zu den beiden von ZecOps veröffentlichten Schwachstellen verfügbar. Der ZecOps Report ist somit die einzige Quelle für die Bewertung der BSI Warnung.

Um welchen Typ von Schwachstellen handelt es sich?

ZecOps hat eine “Out-Of-Bounds Write” und eine “Remote Heap Overflow” Schwachstelle in der iOS Mail App entdeckt. Diese „Buffer Overflow“ Schwachstellen bilden die Grundlage für die sogenannten Remote Code Execution Schwachstellen, die in der Regel als „kritisch“ eingestuft werden, da sie das Einschleusen von fremden Code in ein Programm erleichtern. Damit führt das Programm nicht mehr die beabsichtigten Anweisungen durch, sondern diejenigen, die der Cyberangreifer vorgibt. Soweit ist die Einschätzung des BSI korrekt.

Wer ist im Fokus der Angreifer?

ZecOps macht zu Beginn des Reports eine sehr interessante Aussage:

“Based on ZecOps Research and Threat Intelligence, we surmise with high confidence that these vulnerabilities – in particular, the remote heap overflow – are widely exploited in the wild in targeted attacks by an advanced threat operator(s).”

ZecOps vermutet mit hoher Sicherheit, das die Schwachstellen in großem Umfang in gezielten Angriffen ausgenutzt werden, und zwar von staatlichen Cyber-Akteuren oder von staatlich finanzierten Cyber-Akteuren. Seltsamerweise ist der Hinweis auf die „advanced threat operators“ (APTs) nicht fett markiert; damit ist das re-blog und re-tweet gesichert.

Im Fokus von APTs sind Mitglieder in den Vorständen von Großkonzernen und Betreiber kritischer Infrastrukturen, hochrangige Mitglieder von staatlichen Organisationen, kritische Journalisten, etc. Der normale iPhone oder iPad Anwender eher nicht, wenn überhaupt, dann als Kollateralschaden.

Was sind die Auswirkungen eines erfolgreichen Angriffs?

ZecOps schreibt im Abschnitt Fragen und Antworten dazu:

“Q: What does the vulnerability allow?

A: The vulnerability allows to run remote code in the context of MobileMail (iOS 12) or maild (iOS 13). Successful exploitation of this vulnerability would allow the attacker to leak, modify, and delete emails.”

Nach einem erfolgreichen Angriff kann der Angreifer also E-Mails lesen, löschen, kopieren und verändern; E-Mails schreiben im Namen des Nutzers ist nicht beschrieben. Damit sind die Vertraulichkeit und die Integrität der Information zumindest teilweise nicht mehr gegeben.

Ist der Angriffs einfach ausführbar?

Im Abschnitt Q&A macht ZecOps dazu eine sehr bemerkenswerte Aussage:

Q: Does the vulnerability require additional information to succeed?

A: Yes, an attacker would need to leak an address from the memory in order to bypass ASLR. We did not focus on this vulnerability in our research.“

Damit der Schadcode vom Angreifer an die richtige Stelle im Adressraum eingeschleust werden kann, muss eine zusätzliche Schwachstelle vorhanden sein. ASLR (Adress Space Layout Randomization) ist eine in allen modernen Prozessoren eingebaute Technologie, die Angreifern das Einschleusen von Schadcode in den Speicher von Programmen erschweren soll. Wird der Schadcode an die falsche Stelle im Speicher eingefügt, führt dies zum Absturz des mit ASLR geschützen Programms. Mehr dazu von Paul Ducklin im Sophos Blog.(6)

In der Regel haben nur APTs die finanziellen Mittel solche Angriffe so zu vorzubereiten und auszuführen, dass die frühzeitige Entdeckung des Angreifers und der Schwachstelle verhindert wird.

Kann das Gerät vollständig übernommen werden?

Im Abschnitt Q&A macht ZecOps dazu folgenden Aussage:

„Q: Why are you disclosing these bugs before a full patch is available?

Answer: It’s important to understand the following:

These bugs alone cannot cause harm to iOS users – since the attackers would require an additional infoleak bug & a kernel bug afterwards for full control over the targeted device.

Für die vollständige Übernahme des Gerätes ist also eine weitere Schwachstelle im Betriebssystemkern erforderlich. Das kann nur eine bislang nicht veröffentlichte Schwachstelle sein (Zero-Day), da die Bekannten gepatcht sind.

Eine Cyberwaffe, die auf einer nicht veröffentlichten Schwachstelle basiert kann ein einziges Mal eingesetzt werden. Danach ist die Schwachstelle bekannt und wird binnen kurzer Zeit gepatcht; die Waffe wird wirkungslos. Hier stellt sich die Frage, welcher APT eine wertvolle Cyberwaffe für das Ausspähen normaler iPad- oder iPhone-Nutzer opfert? Mehr dazu findet man in der Analyse(5) von Thomas Reed im Malwarebyte Labs Blog.

Fazit: Kein Grund zur Panik!

Aus meiner Sicht stehen die Warnung des BSI und die Aufmerksamkeit in den Medien in keinem Verhältnis zur Gefährlichkeit der Schwachstelle. Oder mit Shakespeare: Viel Lärm um Nichts.

Personengruppen im Fokus von staatlichen oder staatlich finanzierten Cyber-Akteuren sollten die E-Mail Synchronisation deaktivieren, bis die Schwachstelle gepatcht ist. Gegebenenfalls können die Mail-Gateway Betreiber für diese Benutzergruppen Anhänge entfernen oder übergroße E-Mails blockieren, falls das Deaktivieren der Synchronisation aus organisatorischen Gründen nicht möglich ist.

Für alle anderen Nutzer gilt: Patches installieren, sobald sie verfügbar sind. Wer glaubt, im Fokus staatlicher oder staatlich finanzierter Cyber-Akteure zu stehen, sollte die Mailsynchronisation deaktivieren, bis ein Patch verfügbar ist.


Referenzen

  1. zdf heute. Behörde schlägt Alarm: Sicherheitslücken in Mail-App [Internet]. zdf heute. 2020 [zitiert 24. April 2020]. Verfügbar unter: https://www.zdf.de/uri/cdb2ab06-ab06-4416-8a38-2a417e176cc1

  2. Römermann S. BSI warnt vor iOS – Schwachstellen bei Apple Mail-Programm [Internet]. Deutschlandfunk. 2020 [zitiert 25. April 2020]. Verfügbar unter: https://www.deutschlandfunk.de/bsi-warnt-vor-ios-schwachstellen-bei-apple-mail-programm.766.de.html?dram:article_id=475410

  3. Bundesamt für Sicherheit in der Informationstechnik. BSI – Presseinformationen des BSI – BSI warnt vor Einsatz von iOS-App „Mail“ [Internet]. BSI Presse. 2020 [zitiert 25. April 2020]. Verfügbar unter: https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2020/Warnung_iOS-Mail_230420.html

  4. zecOps. You’ve Got (0-click) Mail! [Internet]. ZecOps Blog. 2020 [zitiert 24. April 2020]. Verfügbar unter: https://blog.zecops.com/vulnerabilities/youve-got-0-click-mail/

  5. Reed T. iOS Mail bug allows remote zero-click attacks [Internet]. Malwarebytes Labs. 2020 [zitiert 24. April 2020]. Verfügbar unter: https://blog.malwarebytes.com/mac/2020/04/ios-mail-bug-allows-remote-zero-click-attacks/

  6. Ducklin P. iPhone zero day – don’t panic! Here’s what you need to know – Naked Security [Internet]. naked security by Sophos. 2020 [zitiert 24. April 2020]. Verfügbar unter: https://nakedsecurity.sophos.com/2020/04/23/iphone-zero-day-dont-panic-heres-what-you-need-to-know/

Two unpatched remote code execution flaws in Adobe Type Manager Library affect all Windows Versions. Keep the mitigations forever!

29 March 2020

Mohit Kumar‘s post (1) that was published past Monday on The Hacker News should instill fright to all users who haven’t migrated to Windows 10 yet.

The good news is that this vulnerability requires user interaction. Microsoft states in security advisory ADV200006 (2) that “There are multiple ways an attacker could exploit the vulnerability, such as convincing a user to open a specially crafted document or viewing it in the Windows Preview pane.” As always, user training is as crucial!

In addition, the impact on Windows 10 users is limited because the malicious code runs in an AppContainer which is destroyed once the preview is closed.

The bad news is that Microsoft recognized attacks where this vulnerability is leveraged (the vulnerability is in the Wild). And, a patch is not available yet.

In the meantime, Microsoft provides important mitigations in ADV200006. These mitigations must be kept on all pre-Windows 10 systems where no Extended Security Update (ESU) support is available.

The most interesting mitigation is to “Disable the Preview Pane and Details Pane in Windows Explorer”. I always disable preview features in Explorer and Outlook. Simply put, preview requires that documents are “executed”, so preview may also execute embedded malicious code.

My advice for all critical infrastructure operators is:

  • Deactivate all preview features in the Windows OS and in all applications.
  • Deactivate any kind of macros and scripting without notification.
  • Deactivate all trusted locations in all applications.
  • And, of course, the user should not be able to reverse this settings.

With this, the security baseline is raised at moderate effort.

Have a great week.


1. Kumar M. Warning — Two Unpatched Critical 0-Day RCE Flaws Affect All Windows Versions [Internet]. The Hacker News. 2020 [cited 2020 Mar 29]. Available from: https://thehackernews.com/2020/03/windows-adobe-font-vulnerability.html

2. MSRC. ADV200006 | Type 1 Font Parsing Remote Code Execution Vulnerability [Internet]. Microsoft Security Response Center. 2020 [cited 2020 Mar 29]. Available from: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200006

CVE-2020-0796 – New Critical SMB V3 Vulnerability. Time to Panic?

22 March 2020

On March 12, 2020 Microsoft published a CVSS V3.1 severity 10 vulnerability in the SMBv3 protocol. CVE-2020-0796 (1), also called CoronaBlue, impacts the Windows 10 client and server versions 1903 and 1909.

The bad news first. CoronaBlue is like Eternalblue/WannaCry a wormable remote code execution vulnerability. A single Windows 10 system with SMBv3 protocol installed and port 445 open to the internet is enough for infiltration of a network.

The good news is that only few systems with Windows 10 version 1903 or 1909 have port 445 exposed to the internet. Theses Windows versions are just too new.

Nevertheless, immediate patching is required because a proof of concept exploit code was published on March 14, 2020.

In addition, Microsoft recommends deactivating SMBv3 compression unless the patches are installed and activated (2).

But the most important advice Microsoft gives is:

Blocking the affected ports at the enterprise perimeter is the best defense to help avoid Internet-based attacks.

This advice holds for all SMB versions. There is no need to access Windows systems through the SMB protocol from the internet. Therefore, this protocol should be blocked by the internet facing firewall of DMZs. No exceptions! Apparently, some thousand CISOs do not care:

Windows systems with SMB ports open to the internet.

Windows systems with SMB ports open to the internet.

Have a great week. And check your firewall rules!


References

  1. NIST NVD. NVD – CVE-2020-0796 [Internet]. NIST Information Technology Laboratory. 2020 [cited 2020 Mar 22]. Available from: https://nvd.nist.gov/vuln/detail/CVE-2020-0796
  2. MSRC. CVE-2020-0796 | Windows SMBv3 Client/Server Remote Code Execution Vulnerability [Internet]. Microsoft Security. [cited 2020 Mar 22]. Available from: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796

Microsoft previews Microsoft Defender ATP for Linux – No reason to celebrate!

7 March 2020

At the Ignite 2019 Microsoft announced that “Defender ATP is coming to Linux in 2020” (1). The preview version is available since the end of February (2).

To be clear, I think Microsoft Defender ATP is a good product. It benefits from millions of sensors installed on consumer and company computers. And, with the entire Defender suite installed, companies can gain a good security level.

COVID-19 Virus ultrastructural morphology

COVID-19 Virus ultrastructural morphology. Picture by CDC/ Alissa Eckert, MS; Dan Higgins, MAMS

Just to recap on why we need anti-malware products: We live in an operating system monoculture. Windows is everywhere, on the clients, on the servers, in the cloud. All windows systems are networked for reasons of efficiency. The drawback of all mononcultures is that they are vulnerable against diseases. Covid-19 is a current example in the real world, WannaCry and NotPetya are well known examples in cyber space.

Microsoft loves Linux, and starts implanting genes from the Windows DNA into the Linux DNA; the .Net framework, PowerShell, Windows Defender ATP. Since the cost pressure in IT is high, companies will start using this products.

Good for the EBIT, bad for cyber security. PowerShell for example is often used in malware attacks (3). It’s merely a matter of time before cyber attackers start leveraging PowerShell on Linux. Living off the Land attacks will work on Linux and Windows, in the worst case with no changes to the code. With that, Linux is getting vulnerable against attacks that were so far only known from Windows.

Especially for operators of critical infrastructures is a clear strategy for operating Microsoft products on Linux required to keep the risk from this cross-over at an acceptable level.

For advice in securing PowerShell see publication “Securing PowerShell in the Enterprise” of the Australian Cyber Security Center (4).

Have a great weekend!


References

  1. Tung L. Microsoft: Defender ATP is coming to Linux in 2020 [Internet]. ZDNet. 2019 [cited 2020 Mar 7]. Available from: https://www.zdnet.com/article/microsoft-defender-atp-is-coming-to-linux-in-2020/
  2. Vaughan-Nichols SJ. Microsoft previews Microsoft Defender ATP for Linux [Internet]. ZDNet. 2020 [cited 2020 Mar 7]. Available from: https://www.zdnet.com/article/microsoft-previews-microsoft-defender-atp-for-linux/
  3. Help Net Security. 91% of critical incidents involve known, legitimate binaries like PowerShell [Internet]. Help Net Security. 2018 [cited 2020 Mar 6]. Available from: https://www.helpnetsecurity.com/2018/06/28/incidents-legitimate-binaries/
  4. Australian Cyber Security Center. Securing PowerShell in the Enterprise | Cyber.gov.au [Internet]. Australian Signals Directorate. 2019 [cited 2020 Mar 6]. Available from: https://www.cyber.gov.au/publications/securing-powershell-in-the-enterprise

Mean Time to Hardening: The Next-Gen Security Metric falls short in tackling the patching problem

12 January 2020

In report “Mean Time to Hardening: The Next-Gen Security Metric”,(1) published at 12/30/2019 on ThreatPost, Richard Melick proposes a new metric MMTH (Mean time to Hardening) to tackle the patch problem. I like the 24/72 MTTH approach. But when it comes to attacks of APTs on critical infrastructures this approach is from my point of view not effective.

Let me illustrate this with an example. CVE-2017-5638, a remote command execution vulnerability in the Apache Struts framework, was used in the Equifax attack (2) in 2017. In the case of remote command execution vulnerabilities, especially if the systems are operated in the DMZ, the 24/72 MTTH approach is the best strategy to survive. But let us look on the timeline.

NVD Exploit-DB Exploit-DB
CVE-2017-5638 EDB-ID 41570 EDB-ID 41614
Published NDV Published Exploit-DB Published Exploit-DB
3/11/2017 3/7/2017 3/15/2017

Exploit 41570 was published 4 days before the CVE was published. The 24/72 MTTH strategy will fail in this case. Exploit 41614 was published 4 days after the CVE was published, so the 24/72 MTTH strategy is successful.

Figure 1

Figure 1

This is not an isolated case. Between 2013 and 2019 56% of the exploits were published before or at the same day the vulnerability was published in the NVD. For mapping the exploits in the Exploit-DB to the CVEs the NVD reference map for the Exploit-DB (3) is used. Figure 2 shows the details in the range 30 days before and after the CVE publication date.

Figure 2

Figure 2

Figure 3

Figure 3

34% of the exploits for Remote Code/Command Execution (RxE) vulnerabilities like CVE-2017-5638 or CVE-2017-0144 (WannaCry) were published before or at the same day the vulnerability was published. Figure 4 shows the details. RxEs are selected from the NVD as follows: CVSS V2.0: Attack Vector: Network, Attack Complexity: Low + Medium, Authentication: None, Loss of Integrity: Complete, Keywords “remote code execution” or “exec arbitrary”.

Figure 4

Figure 4

So, the 24/72 MMTH approach falls short if the exploit is published before the vulnerability.

Please keep in mind that we only investigated published vulnerabilities and exploits. We can expect, that many yet unpublished, and unused, vulnerabilities exist in the arsenals of the APTs.

In the case of critical infrastructures, we are well advised to invest in solutions which increase the resilience against cyber-attacks. A simple Apparmor profile would probably have prevented the attack on Equifax. Whitelisting solutions should be considered in environments where industrial control systems are operated. This makes the 24/72 MTTH approach to patching not obsolete. We just buy time.

Have a great week.


References

  1. Melick R. Mean Time to Hardening: The Next-Gen Security Metric [Internet]. threatpost. 2019 [cited 2020 Jan 12]. Available from: https://threatpost.com/mean-time-hardening-next-gen-security-metric/151402/
  2. Brook C. Equifax Confirms March Struts Vulnerability Behind Breach [Internet]. threatpost. 2017 [cited 2020 Jan 12]. Available from: https://threatpost.com/equifax-confirms-march-struts-vulnerability-behind-breach/127975/
  3. NIST NVD. CVE – CVE Reference Map for Source EXPLOIT-DB [Internet]. [cited 2020 Jan 12]. Available from: https://cve.mitre.org/data/refs/refmap/source-EXPLOIT-DB.html

Plundervolt. Don’t panic!

16 December 2019

Last Tuesday, Intel (1) published a patch for a new hardware vulnerability dubbed Plundervolt (CVE-2019-11157). As always with hardware vulnerabilities, Plundervolt got a lot of attention in the media.(2)(3)(4) A Google search for “plundervolt intel” shows about 167.000 hits as of today. The vulnerability was detected by a research team lead by Kit Murdock (5) some month ago.

In parallel, Microsoft published a patch for the privilege escalation vulnerability CVE-2019-1458.(6) CVE-2019-1458 is actively used in attacks (7), so it also got some media attention (Google search “CVE-2019-1458”: 88.000 hits as of today).

Plundervolt logo.

Plundervolt logo.

From my point of view, hardware vulnerabilities are always somewhat overvalued, especially in terms of their benefit in cyber operations. The vulnerabilities named RyzenFall, FallOut, Chimera and MasterKey in AMD processors, which were discovered last year, are maybe the best examples.(8) So, lets take a closer look on PlunderVolt and CVE-2019-1458.

The table below shows the CVSS V3.1 Severity for the vulnerabilities.

Plundervolt CVE-2019-1458 comparison

Plundervolt / CVE-2019-1458 comparison

The main difference is in the Privileges Required (PR) to exploit the vulnerability. For Plundervolt, Murdock et al. “assume the standard Intel SGX adversary model where the attacker has full control over all software running outside the enclave (including privileged system software such as operating system and BIOS).”(5) That means that the system must already be fully compromised before Plundervolt can be exploited.

In contrast, CVE-2019-1458 allows the attacker to acquire high privileges on a system once he hijacked a standard user account. So, by exploiting CVE-2019-1458 the attacker sets up the environment to exploit Plundervolt.

From an attacker’s point of view, CVE-2019-1458 is more valuable than Plundervolt. Once one system is compromised, the attacker can use it as base of operations for the exploration of the victim’s network. In the worst case, the Active Directory is compromised within some minutes, so the attacker has access to all secrets, or he can push ransomware to all computers.

For organized crime and APTs, CVE-2019-1458 is a universally exploitable tool to achieve goals.

Plundervolt gets interesting if the attacker is interested in encryption key details which are used internally only, for example in Transparent Database Encryption (TDE) or in trusted execution environments. Murdock et al. “demonstrate the effectiveness of our attacks by injecting faults into Intel’s RSA-CRT and AES-NI implementations running in an SGX enclave, and we reconstruct full cryptographic keys with negligible computational efforts.”(5) In the worst case, this results in the loss of all data in a TDE secured database, since vendors use Intel’s AES-NI on-chip implementation to speed up cryptographic computations.

So, Plundervolt is interesting for organized crime and APTs when it comes to industrial espionage or in attacks against targets which are relevant for national security.

Fortunately, the time frame for exploitation is short. The patch for CVE-2019-1458 will be automatically rolled out through the WSUS infrastructure within the next weeks. Plundervolt should be patched, with high priority on critical systems, if a company is target of espionage or operates critical infrastructures.

Do you know your threat profile and critical systems? Without this knowledge efficient vulnerability management is not possible. Not sure? So, take it as a New Year’s resolution…


References

  1. Intel Security Center. INTEL-SA-00289 [Internet]. Intel Security Center. 2019 [cited 2019 Dec 13]. Available from: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00289.html
  2. Gatlan S. Intel Patches Plundervolt, High Severity Issues in Platform Update [Internet]. BleepingComputer. 2019 [cited 2019 Dec 13]. Available from: https://www.bleepingcomputer.com/news/security/intel-patches-plundervolt-high-severity-issues-in-platform-update/
  3. O’Donnell L. Modern Intel CPUs Plagued By Plundervolt Attack | Threatpost [Internet]. threatpost. 2019 [cited 2019 Dec 13]. Available from: https://threatpost.com/intel-cpus-plundervolt-attack/151006/
  4. Khandelwal S. New PlunderVolt Attack Targets Intel SGX Enclaves by Tweaking CPU Voltage [Internet]. The Hacker News. 2019 [cited 2019 Dec 13]. Available from: https://thehackernews.com/2019/12/intel-sgx-voltage-attack.html
  5. Murdock K, Oswald D, Garcia FD, Van Bulck J, Gruss D, Piessens F. Plundervolt: Software-based Fault Injection Attacks against Intel SGX}. In: Proceedings of the 41st IEEE Symposium on Security and Privacy (S&P’20) [Internet]. San Francisco, CA; 2019 [cited 2019 Dec 13]. Available from: https://plundervolt.com/
  6. MSRC. CVE-2019-1458 | Win32k Elevation of Privilege Vulnerability [Internet]. Microsoft Security. 2019 [cited 2019 Dec 16]. Available from: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458
  7. Kaspersky Global Research and Analysis Team. Windows 0-day exploit CVE-2019-1458 used in Operation WizardOpium | Securelist [Internet]. SECURELIST. 2019 [cited 2019 Dec 16]. Available from: https://securelist.com/windows-0-day-exploit-cve-2019-1458-used-in-operation-wizardopium/95432/
  8. Cimpanu C. AMD Confirms RyzenFall, MasterKey, Fallout, and Chimera Vulnerabilities [Internet]. BleepingComputer. 2018 [cited 2019 Dec 16]. Available from: https://www.bleepingcomputer.com/news/hardware/amd-confirms-ryzenfall-masterkey-fallout-and-chimera-vulnerabilities/

World Cafe@IMI 2019: No Backup, No Mercy!

24 November 2019

IMI 2019: Presentation DOW Cyber Security Framework

IMI 2019: Presentation DOW Cyber Security Framework

The motto of the IT meets Industry 2019 (IMI) conference in Mannheim was What happens if shit happened. During the World Cafe session, the participants dealt with the following scenario:

  1. The cyber-criminal overcame all hurdles you put in place to protect your production systems from attacks.
  2. The anomaly detection capabilities in place recognized the attack late.
  3. The engineering station (ES) is compromised.
  4. You isolated the engineering station from the network for further analysis.
  5. The good news is that the process control system (PCS) is still operable.
  6. The bad news is that it’s not clear whether the control program in the PCS is also compromised.

You decide to download the control program from the backup into the PCS. This is no uncommon scenario. The Rogue7 (1) attack described at the Black Hat 2019 and Triton (2) work this way. One of the participants put it this way: No Backup, No Mercy! Unfortunately, it’s not that simple.

Where is the current backup stored?

Under normal conditions, the current control program is stored on the engineering station. But this version is not usable because the engineering station is compromised.  If the backup is well organized, a copy of the control program is available from a NAS or a dedicated backup system

Is it really the current version?

This is very important if you want to recover the PCS to the state before the attack happened. Unfortunately, the Recovery Point Objective (RPO) in production is zero. That means, that the latest version of the control program is required for recovery. Older versions require, in the best case, manual reworking, thus a longer downtime and higher financial loss.

Is the PCS restorable from this version and fully operable afterwards?

Have you ever tried a restore test during scheduled maintenance to make sure that the PCS is fully operable after the restore of the control program? Is it clear what is meant by fully operable? Do you have a procedure and check list in place to verify this?

But the worst is yet to come. If you do daily backups there is a small chance that all backup versions are compromised.  In the above scenario, the anomaly detection system detected the attack late. If you keep for instance the latest 10 versions online and the attacker was active for 14 days, then all backups are potentially compromised. So, you must retrieve a backup from a tape library, if any.

Summary

Backup in the age of cyber attacks and ransomware is a hard job, especially in production. Without a strategy and preparation for the worst case a cyber attack may become a financial disaster. The 7 Ps Rule shows the direction in incident response:

Prior Preparation and Planning Prevents Piss Poor Performance!

Want to participate in real peer to peer knowledge exchange and a World Cafe on hot topics? Join the IMI 2020 in Mannheim.

Have a great week.


References

  1. Biham E, Bitan S, Carmel A, Dankner A, Malin U, Wool A. PPT: Rogue7: Rogue Engineering-Station attacks on S7 Simatic PLCs [Internet]. Powerpoint Presentation presented at: Black Hat USA 2019; 2019 Aug 8 [cited 2019 Aug 16]; Mandalay Bay / Las Vegas. Available from: https://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs.pdf
  2. Sobczak B. SECURITY: The inside story of the world’s most dangerous malware [Internet]. 2019 [cited 2019 May 11]. Available from: https://www.eenews.net/stories/1060123327