Category Archives: Opinion

BSI: Hackerattacke auf Uniklinik Düsseldorf wäre verhinderbar gewesen

16. Januar 2021

Am 11. Januar 2021 berichtete RP Online[i], die „Hackerattacke auf Uniklinik Düsseldorf wäre verhinderbar gewesen“. Laut RP Online sagte der Präsident des BSI auf einen Kongress zur inneren Sicherheit, der Hackerangriff „hätte schon mit dem einfachen Grundschutz des BSI verhindert werden können“. Der Bericht wurde auf LinkedIn am 12.1.2021 geteilt und kommentiert.

Hat das BSI recht? Hätte die Vorgehensweise nach BSI Grundschutz den Angriff verhindert?

Welche Schwachstelle wurde von den Angreifern für den initialen Zugriff genutzt?

Heise Online[ii] berichtet am 22.9.2020, dass vermutlich die Shitrix bezeichnete Schwachstelle CVE-2019-19781 zum Einstieg ins das Netzwerk der Uniklinik verwendet wurde. CVE-2019-19781 ist eine Schwachstelle in den Citrix Produkten Citrix Application Delivery Controller, Citrix Gateway und Citrix SD-WAN WANOP Appliance. Diese Citrix-Produkte werden zur Absicherung des externen Zugriffs auf das private Netzwerk einer Organisation eingesetzt. Sie werden in der Internet-DMZ betrieben und sind in der Regel für alle Internetteilnehmer sichtbar und damit von diesen angreifbar.

Laut Citrix[iii] handelt es sich bei CVE-2019-19781 um eine Remote-Code-Execution-Schwachstelle (RCE). Der Access-Vector[iv] ist CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, die Severity ist 9.8.

Die folgende Tabelle zeigt die zeitliche Entwicklung von der Schwachstelle bis zum Patch.

16.12.2019 Citrix veröffentlicht mitigierende Maßnahmen[v] für CVE-2019-19781, da die Schwachstelle bereits in Angriffen genutzt wurde.
17.12.2019 Citrix veröffentlicht die Schwachstelle[iii].
18.12.2019 Warnung[vi] des BSI, Risikostufe 3.
27.12.2019 Veröffentlichung in der NIST NVD Datenbank[iv].
11.1.2020 Veröffentlichung des ersten Exploit EDB-ID 47901[vii] in der Exploit Datenbank.
13.1.2020 Update Warnung[viii] des BSI, Risikostufe 4.
19.1.2020 Citrix veröffentlich die ersten korrigierten Programmversionen.
24.1.2020 Für alle Programmversionen sind Patches vorhanden.

Citrix berichtet[iii] am 17.12.2019, dass „Exploits of this issue on unmitigated appliances have been observed in the wild. Citrix strongly urges affected customers to immediately upgrade to a fixed build OR apply the provided mitigation which applies equally to Citrix ADC, Citrix Gateway and Citrix SD-WAN WANOP deployments.” Damit handelte es sich bei CVE-2019-19781 um eine Zero-Day-Schwachstelle. Hier ist Eile geboten. Deshalb ist es nicht ungewöhnlich, dass Citrix bereits einen Tag vor der Schwachstelle mitigierende Maßnahmen[v] veröffentlicht hat.

Welche Optionen hat man in derartigen Szenarien?

Option Patchen/Mitigieren

Das Australien Cyber Security Centre (ASCS) macht im Abschnitt System Patching des “Australian Government Information Security Manual”[ix] klare Vorgaben:

Security Control: 1144; Revision: 9; Updated: Sep-18; Applicability: O, P, S, TS; Priority: Must Security vulnerabilities in applications and drivers assessed as extreme risk are patched, updated or mitigated within 48 hours of the security vulnerabilities being identified by vendors, independent third parties, system managers or users.

CVE-2019-19781 hat Severity 9.8, die Ausnutzung der Schwachstelle führt zum vollständigen Verlust der Integrität des Systems. Damit fällt die Schwachstelle in diese Kategorie. Da kein Patch verfügbar war, müssen die von Citrix am 16.12.2020 veröffentlichten mitigierenden Maßnahmen spätestens am 19.12.2019 umgesetzt sein.

Im BSI Grundschutz, Edition 2020[x] vermisst man im Abschnitt OPS.1.1.3: Patch- und Änderungsmanagement diese klaren Hinweise. OPS.1.1.3.A1 gibt folgenden Hinweis: „Patches und Änderungen SOLLTEN nach Wichtigkeit und Dringlichkeit klassifiziert und entsprechend umgesetzt werden.“

Das SOLLTEN ist hier irritierend. SOLLTE bedeutet im Sinne des Grundschutzes, „dass eine Anforderung normalerweise erfüllt werden muss, es aber Gründe geben kann, dies doch nicht zu tun“. Das ist bei CVE-2019-19781 nicht angemessen, da Citrix bereits von “Exploits in the Wild” berichtet hatte. Hier ist ein MÜSSEN im Sinne des Grundschutzes erforderlich.

Folgt man der Einstufung „Risikostufe 3“ in der BSI Warnung von 18.12.2019, so würde man aus meiner Sicht nicht umgehend mitigierende Maßnahmen ergreifen.

Option Firewall mit IPS (virtuelles Patchen)

Nextgen Firewalls mit IPS (Intrusion Prevention System) können gerade bei Zero-Day-Schwachstellen über die Möglichkeit des virtuellen Patchens Cyberangriffe abwehren. Der Firewall entdeckt im Datenstrom Versuche, die Schwachstelle CVE-2019-19781 auszunutzen und blockt diese.

IPS hätte in diesem Fall mit hoher Wahrscheinlichkeit den Angriff nicht verhindert. Checkpoint hat etwa erst am 9.1.2020 ein passendes IPS Muster bereitgestellt, Fortinet am 13.1.2020

Option Application Whitelisting

Die betroffenen Citrix –Systeme können als virtuelle Appliance oder als Anwendung auf einem Linux-System (Bare-Metal) betrieben werden.

Im Fall der Appliance ist Application Whitelisting nicht möglich, da der Betreiber keine Zusatzsoftware installieren kann.

In einer Bare-Metal-Umgebung kann der Systemverantwortliche eine Application Whitelisting-Lösung einsetzen. Da Linux-Server als sicherer wahrgenommen werden als Windows-Server, wird häufig auf zusätzliche Sicherheitslösungen verzichtet.

Application Whitelisting hätte die Übernahme des Citrix Systems in der Bare-Metal-Umgebung mit hoher Wahrscheinlichkeit verhindert, da bei der Übernahme des Systems Code eingeschleust und ausgeführt wird.

Option System von Netzwerk trennen

Liefert der Hersteller weder Patches noch Hinweise auf mitigierende Maßnahmen, so ist die Trennung vom Netzwerk eine mögliche Option. Systemverantwortliche, IT-Manager und IT-Security-Manager sollten diese Option immer vorbereiten und trainieren. Das Risiko aus dem Verlust des Remotezugriffs auf Dienste muss in Relation zu dem Risiko gesetzt werden, das sich durch die Einschränkungen im Betrieb der kritischen Infrastruktur (Universitätsklinik) für die Bevölkerung ergibt.

Wichtig! Systemverantwortliche müssen vorab vom Management autorisiert werden, die Trennung durchzuführen, und dürfen nicht zögern, die Trennung durchzuführen.

Zusammenfassung

Mit Patchen/Mitigieren, Vorgehensweise nach ASCS, hätte die Uniklinik Düsseldorf den Angriff mit hoher Wahrscheinlichkeit verhindern können.

Nach BSI Grundschutz hängt es aus meiner Sicht ausschließlich von der Einschätzung des Systemverantwortlichen ab, ob die mitigierenden Maßnahmen mit der gebotenen Geschwindigkeit umgesetzt werden. Für den Betrieb einer kritischen Infrastruktur ist diese Vorgehensweise zu unverbindlich. Der Angriff hätte aus meiner Sicht durch BSI Grundschutz nicht verhindert werden können.

Die Option System vom Netzwerk trennen hätte den Angriff sicher verhindert.

Firewall IPS hätte den Angriff wahrscheinlich nicht verhindern können, da die Muster zur Exploit-Erkennung zu spät bereitstanden.

Die Option Application Whitelisting hätte den Angriff nur in der Bare-Metal-Umgebung verhindern können.

Haben Sie sich schon mit der Option System vom Netzwerk trennen beschäftigt? Insbesondere in kritischen Infrastrukturen? Über ein Feedback würde ich mich sehr freuen.

Schönes Wochenende.


[i] RP ONLINE. Bundesamt für IT-Sicherheit: Hackerattacke auf Uniklinik Düsseldorf wäre verhinderbar gewesen [Internet]. RP ONLINE. 2021 [zitiert 16. Januar 2021]. Verfügbar unter: https://rp-online.de/nrw/staedte/duesseldorf/uniklinik-duesseldorf-hackerattacke-waere-laut-bsi-verhinderbar-gewesen_aid-55626401

[ii] von Westernhagen O. Uniklinik Düsseldorf: Ransomware „DoppelPaymer“ soll hinter dem Angriff stecken [Internet]. Heise Online Security. 2020 [zitiert 16. Januar 2021]. Verfügbar unter: https://www.heise.de/news/Uniklinik-Duesseldorf-Ransomware-DoppelPaymer-soll-hinter-dem-Angriff-stecken-4908608.html

[iii] Citrix. CVE-2019-19781 – Vulnerability in Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliance [Internet]. Support Knowledge Center. 2019 [zitiert 16. Januar 2021]. Verfügbar unter: https://support.citrix.com/article/CTX267027

[iv] NIST National Vulnerability Database. NVD – CVE-2019-19781 [Internet]. NATIONAL VULNERABILITY DATABASE. 2020 [zitiert 16. Januar 2021]. Verfügbar unter: https://nvd.nist.gov/vuln/detail/CVE-2019-19781

[v] Citrix. Mitigation Steps for CVE-2019-19781 [Internet]. Support Knowledge Center. 2019 [zitiert 16. Januar 2021]. Verfügbar unter: https://support.citrix.com/article/CTX267679

[vi] Bundesamt für Sicherheit in der Informationstechnik. BSI – CERT Bund -Meldungen – CB-K19/1093 [Internet]. Service. 2019 [zitiert 16. Januar 2021]. Verfügbar unter: https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k19-1093.html

[vii] Project Zero India. Citrix Application Delivery Controller and Citrix Gateway – Remote Code Execution (PoC) [Internet]. Exploit Database. 2020 [zitiert 16. Januar 2021]. Verfügbar unter: https://www.exploit-db.com/exploits/47901

[viii] Bundesamt für Sicherheit in der Informationstechnik. BSI – CERT Bund -Meldungen – CB-K19/1093 Update 2 [Internet]. 2020 [zitiert 16. Januar 2021]. Verfügbar unter: https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2020/01/warnmeldung_cb-k19-1093_update_2.html

[ix] Australian Cyber Security Centre. Australian Government Information Security Manual [Internet]. 2019 [zitiert 16. Januar 2021]. Verfügbar unter: https://www.cyber.gov.au/sites/default/files/2019-04/Australian%20Government%20Information%20Security%20Manual%20(APR19)_0.pdf

[x] Bundesamt für Sicherheit in der Informationstechnik. IT-Grundschutz-Kompendium [Internet]. Reguvis Fachmedien GmbH; 2020 [zitiert 16. Januar 2021]. Verfügbar unter: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/Kompendium/IT_Grundschutz_Kompendium_Edition2020.pdf

Your Ransomware Strategy 2021: Prevention or Bow to the Inevitable?

1 January 2021

This morning I read the transcript of the Threatpost webinar ” What’s Next for Ransomware”.[1] Becky Bracken hosted the webinar some weeks ago, panelists were Limor Kessem (IBM Security), Allie Mellen (Cyberreason) and Austin Merritt (Digital Shadows). The discussion focused on incident response:

“While IT departments will undoubtedly lead efforts to shore up defenses against attacks, including backups, patching, updating and employee-awareness training, our panel of experts agree that preparing a critical-response plan which includes the entire organization — from the executives on down the org chart — is the best way to minimize cost, damage and downtime.”

Having a well-crafted and trained incident response plan in place is, from my point of view, an indispensable means to recover from all kind of cyber-attacks. But is it “the best way to minimize cost, damage and downtime” in the case of Ransomware?

Response plans come into play when a ransomware attack is detected. But during the time until detection, the ransomware may cause damage to the network and the data. Once detected, incident response kicks in by taking appropriate actions to

  • containing the attack,
  • investigating the network for yet undetected instances of the ransomware,
  • repairing the already done damage, etc.

This is close to Gartner’s[2] approach to defend ransomware, so industry standard. But is this reactive approach the best way to minimize the economic impact of an attack?

The Cyber Security and Infrastructure Security Agency (CISA) describes in its Ransomware Guide[3] a more preventive approach. Backup, patching, cyber-hygiene, awareness training and cyber incident response plan are the building blocks. In addition, CISA recommends to “Use application directory allowlisting on all assets to ensure that only authorized software can run, and all unauthorized software is blocked from executing”.[3] This is a clear step towards prevention of attacks. Since ransomware comes from external sources e.g., through internet, e-mail, usb-devices, it commonly is not part of the allow-list, thus blocked.

The Department of Homeland Security (DHS) goes one step further in its 2016 published paper “Seven Strategies to Defende ICS”.[4] The first strategy is “Implement Application Whitelisting” because it “can detect and prevent attempted execution of malware uploaded by adversaries”.

Finally, the Australian Cyber Security Centre (ACSC) recommends Application Whitelisting as Number One of Essential Eight[5][6] strategies to prevent malware delivery and execution.

Neither Gartner nor the experts in the Threatpost webinar mentioned preventive controls to deal with ransomware. DHS and ACSC recommend them as central part of a cyber-security strategy.

From my point of view, application whitelisting is a must have to minimize the economic impact of an attack. If execution of malware is prevented, the costs to cleanup and recover from a ransomware attack are minimized.

The baseline security costs are for certain increased because application whitelisting solutions must be managed like any other application. This holds even if the Windows built-in tools AppLocker or Software Restriction Policies are used. But this will be balanced by the fact that application whitelisting will prevent also zero-day malware or PUA from execution.

CISA and ACSC provide useful hints on dealing with ransomware without big invest in new tools. It makes sense to take them into account when revising your security roadmap for 2021.

Happy New Year!

And have a great weekend.


[1] Bracken B. What’s Next for Ransomware in 2021? [Internet]. threatpost. 2020 [zitiert 1. Januar 2021]. Verfügbar unter: https://threatpost.com/ransomware-getting-ahead-inevitable-attack/162655/

[2] Sakpal M, Webber P. 6 Ways to Defend Against a Ransomware Attack [Internet]. Smarter with Gartner. 2020 [zitiert 1. Januar 2021]. Verfügbar unter: https://www.gartner.com/smarterwithgartner/6-ways-to-defend-against-a-ransomware-attack/

[3] Cyber Security and Infrastructure Security Agency. Ransomware Guide [Internet]. CISA Publications Library. 2020 [zitiert 8. Oktober 2020]. Verfügbar unter: https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware%20Guide_S508C.pdf

[4] U.S. Department of Homeland Security. Seven Strategies to Defend ICSs [Internet]. DoD’s Environmental Research Programs. 2016 [zitiert 13. Oktober 2020]. Verfügbar unter: https://www.serdp-estcp.org/serdp-estcp/Tools-and-Training/Installation-Energy-and-Water/Cybersecurity/Resources-Tools-and-Publications/Resources-and-Tools-Files/DHS-ICS-CERT-FBI-and-NSA-Seven-Steps-to-Effectively-Defend-Industrial-Control-Systems

[5] Australian Cyber Security Center. Strategies to Mitigate Cyber Security Incidents [Internet]. 2017 [zitiert 1. Dezember 2020]. Verfügbar unter: https://www.cyber.gov.au/acsc/view-all-content/publications/strategies-mitigate-cyber-security-incidents

[6] Australian Cyber Security Center. Essential Eight Explained [Internet]. [zitiert 1. Dezember 2020]. Verfügbar unter: https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-explained

The Eternal Battle over Active Directory between OT and IT

29 October 2020

On October 13th I moderated the anapur Virtual Dialog “Network Monitoring and Anomaly Detection”. During the breaks, some participants from industry talked about a really concerning issue: IT, IT-Security and GRC groups in their companies urge them to integrate their so far isolated production active directories in the corporate directory.

I have been involved in these discussion for 10 years and I never changed my answer:

Don’t do it!

This integration is dangerous. Active Directory simplifies lateral movement once an attacker created a foothold in your network. And it simplifies the distribution of malware through login scripts. Remind the Norsk Hydro attack from March 2019: Divisions with high vertical integration were more affected from LockerGoga than the Alumina production.

In their paper “Seven Strategies to Defend ICSs” from December 2016, DHS ICS-CERT, FBI and NSA provide a very clear active directory strategy:

Never share Active Directory, RSA ACE servers, or other trust stores between corporate and control networks.

For details see chapter 5, “Manage Authentication”.

Hope this helps in discussions with IT, IT-Security and GRC.


In his poem Ulysses, Alfred Tennyson brings it to the point:

Tho‘ much is taken, much abides;
and though we are not now that strength
which in old days moved earth and heaven;
that which we are, we are;
one equal temper of heroic hearts,
made weak by time and fate,
but strong in will to strive, to seek, to find.
And not to yield.

The Boothole Vulnerability – Need to Panic?

23 August 2020

CVE-2020-10173 (aka BootHole(1)) got much attention in the media in the past weeks  because this flaw in GRUB 2 may be used to tamper the boot process. But the worst is yet to come. “This flaw also allows the bypass of Secure Boot protections.”(2)

From the description in the NIST NVD we learn: “In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining [a] physical access, [b] obtain the ability to alter a pxe-boot network, or have [c] remote access to a networked system with root access.”(2)

Options [b] and [c] do not really matter. Once an attacker gets the opportunity to modify the network boot capabilities of your system, or has root access to your system, the game is over. In this case, exploiting BootHole is rather counterproductive because the probability of detection goes up.

Fedora32 EFI Partion

Fedora EFI Partition

But BootHole becomes a serious issue if an attacker gets physical access (option [a]) to an unpatched system. These so-called Evil Maid attacks work even on secured Linux systems because the EFI (FAT) partition is easy to modify after the computer is booted from a Linux Live System.

In the case, you followed the industry best practices and secured the BIOS of your computer with a password, the attacker must extract the hard disk and run the change on another system. This is not uncommon when it comes to espionage, terrorism, or sabotage.

But the group of persons in focus of such activities is already vulnerable against Evil Maid attacks. So, the additional risk that stems from BootHole is neglectable. No need to panic!

Nevertheless, install the patch as soon as possible. And secure the BIOS of your computer with a password.

Dell Vostro Laptop with Fedora32/EFI

Dell Vostro Laptop with Fedora Linux/EFI

But the best advice is: Don’t leave your devices unattended. Even the hotel safe is no safe place.

My preferred solution to Evil Maid attacks, the lightweight version, is Fedora Linux on a micro SD-Card.

Have a great week.


References

  1. Eclypsium. There’s a Hole in the Boot [Internet]. Eclypsium. 2020 [cited 2020 Aug 18]. Available from: https://eclypsium.com/wp-content/uploads/2020/08/Theres-a-Hole-in-the-Boot.pdf
  2. NIST Information Technology Laboratory. NVD – CVE-2020-10713 [Internet]. NATIONAL VULNERABILITY DATABASE. 2020 [cited 2020 Aug 23]. Available from: https://nvd.nist.gov/vuln/detail/CVE-2020-10713

CIS Password Policy Guide – A Quantum Leap in User Experience and Security

8 August 2020

The Password Policy Guide(1) published by the Center for Internet Security (CIS) on 29 July 2020 drowned in the omnipresent noise of vulnerabilities and data breaches.

Wrongly, because the CIS guide puts an end to the commonly accepted practice of complex passwords, namely those that are easy to crack but hard to remember.

The guide recommends:

  • The use of passphrases because users will select longer, more-secure passwords.
  • Event-based password expiration with an annual change as a backstop.
  • And the use of password managers.

Especially for password managers the guide recommends:

Use of these should be actively encouraged for use with password-only authentication systems (especially if the user needs to manage access to multiple of these systems)”

And, where “feasible, using MFA instead of just a master password to gain access to the Password Manager is preferred”

Yubikey for MFA and KeePassXC

For some months now I mainly work on a Linux desktop. Unfortunately, I often must switch to Windows because of Word and Powerpoint. So, I use KeePassXC to allow easy switching between the operating systems.

My cloud account is secured with Yubikey, and so is my KeePassXC database. Works fine on Windows and Linux.

To boost user experience and password security, please give the CIS Password Policy Guide the attention it deserves.

Have a great weekend.


References

  1. White Paper: CIS Password Policy Guide [Internet]. Center for Internet Security. [cited 2020 Aug 8]. Available from: https://www.cisecurity.org/white-papers/cis-password-policy-guide/.

The most important questions to ask in a firewall rule assessment

25 June 2020

Regular firewall rule assessments are basic IT/OT security housekeeping procedures. Security staff challenges every rule after well-known industry best practice like ANY Computer or ANY Port rules, bi-directional rules, use of unsecure protocols like ftp, telnet, smb, not used rules, etc.

Nervennahrung for firewall assessment. Own work.

Picture 1: Nervennahrung for firewall rule assessments

Compliance to industry best practice can be achieved with a plain checklist. Thus the check can be automated to a far extent. The nerve-racking work starts afterwards, when each finding is discussed with the users.

But, in general, the security staff does not challenge the rule itself. Or it’s direction. Or the ports used.

These questions are asked after the rule has passed the best practice checks. No automation possible. They require in-depth knowledge of the services accessed through the firewall, and, they belong to the nerve-racking category. But it’s worth to ask these questions because

The best firewall rule is the one that not exists.

You must not care of such rules in the case of a security incident, no regular review required, no discussion with users. Entrepreneurs should be interested in cleaning up the rule base because it saves costs, and increases security.

More about this in the next post.


Picture credits

Picture 1: Vienna 2020. Own work

Australia Fights Sophisticated State-Backed Copy-Paste Attack with The Essential Eight!

20 June 2020

Reports on a wave of sophisticated nation state sponsored cyber-attacks against Australian government agencies and critical infrastructure operators spread like wild-fire through international media the day before yesterday.

From an IT security point of view, the access vector is really interesting. In Advisory 2020-008 (1) , the Australian Cyber Security Centre (ACSC) states that the actor leverages mainly a remote code execution vulnerability in unpatched versions of Telerik UI, a deserialization vulnerability in Microsoft Internet Information Services (IIS), a 2019 SharePoint vulnerability, and the 2019 Citrix vulnerability.

The name Copy-Paste for the attacks comes from the actor’s “capability to quickly leverage public exploit proof-of-concepts to target networks of interest and regularly conducts reconnaissance of target networks looking for vulnerable services, potentially maintaining a list of public-facing services to quickly target following future vulnerability releases. The actor has also shown an aptitude for identifying development, test and orphaned services that are not well known or maintained by victim organizations.” (1)

The Essential Eight

The Essential Eight (Click to enlarge)

In the advisory the ACSC recommends some really basic preventive measures like patching or multi-factor authentication. These are two controls of “The Essential Eight”(2). I like the name “The Essential Eight”. It reminds me on the 1960 Western-film “The Magnificent Seven”, reinforced by Chuck Norris 😉

The Essential Eight focus on very basic strategies to reduce the likelihood and the impact of an attack. Without them, UEBA, SIEM, Threat Intelligence, Deep Packet Inspection, PAM, etc. make few sense.

Except of multi-factor authentication, The Essential Eight are part of the feature-rich Windows and Linux OS or already (backup solution) in place. So, only some internal effort and leadership is required to dramatically increase the resilience against cyber-attacks.

The Essential Eight are a prefect weekend reading. Have fun.


References

  1. Advisory 2020-008: Copy-paste compromises – tactics, techniques and procedures used to target multiple Australian networks | Cyber.gov.au [Internet]. [cited 2020 Jun 19]. Available from: https://www.cyber.gov.au/threats/advisory-2020-008-copy-paste-compromises-tactics-techniques-and-procedures-used-target-multiple-australian-networks
  2. Australian Cyber Security Center. Essential Eight Explained | Cyber.gov.au [Internet]. Australian Signals Directorate. 2020 [cited 2020 Jun 19]. Available from: https://www.cyber.gov.au/publications/essential-eight-explained

An endless stream of SMB vulnerabilities …

11 June 2020

SMBleed, SMBLost, and SMBGhost/CoronaBlue are the vulnerabilities detected in the Microsoft SMB V3 protocol this year.

Critical SMB Vulnerabilities

Critical SMB Protocol Vulnerabilities

SMBleed/SMBGhost can be used to compromise a company network by attacking a system in the DMZ with port 445 open to the internet. Fortunately, SMBleed and SMBGhost impact only the latest Windows 10 versions. The number of Windows 10 systems directly accessible from the internet is still small.

Vulnerable Windows 10 1909 Pro Systems

Vulnerable Windows 10 1909 Pro Systems

Like EternalBlue, SMBLost impacts all Windows versions but is less critical because authentication (PR:L) is required.

The good news is that patches were available at the time the vulnerabilities were published. But it takes some weeks to implement them. During this time companies remain vulnerable against cyber-attacks.

Vulnerability management / priority patching is the standard approach to this kind of vulnerabilities. IT staff is kept busy, IT security solution and service providers make a good bargain, but the company’s resilience against cyber-attacks stays low. Companies can only hope that also the next SMB vulnerability is disclosed after a patch is available.

From an entrepreneurial point of view the obvious solution is to remove such systems from the internet. A risk assessment is imperative to evaluate the potential loss of sales and the costs of recovering from a cyber-attack. If the recovery costs exceed the potential loss of sales the system should be removed. This will slightly reduce IT costs but increase the resilience against such kind of cyber-attacks.

It is high time to evaluate IT[-security solutions] from an entrepreneurial point of view, in terms of Loss of Sales and Loss of EBIT.

Have a great weekend.

New study shows: Vulnerabilities in popular open source projects doubled in 2019. No need to panic!

9 June 2020

Catalin Cimpanu’s (1) post on the RiskSense study “The Dark Reality of Open Source” is well worth reading. Open source software is used everywhere. A critical vulnerability in an application that is based on open source software can lead to a data breach. But this holds also for commercial software. We can also expect that the number of flaws in open source and commercial software is roughly the same.

The main difference is that the number of open source software reviews is much higher than the number of commercial software reviews. So the results of the study are not really surprising.

In the case of TomCat, 7 of the 72 published vulnerabilities were weaponized. A quick check against the latest Coverity scan results for Apache TomCat (2) shows that the software has 987 defects, thereof 290 not yet fixed.

High impact defects are very valuable for attackers because their exploitation results in a full loss of integrity. The number of high impact defects in TomCat yet not fixed is 171. So we can expect that the number of vulnerabilities that can be weaponized is high.

In the case of Puppet, none of the 72 published vulnerabilities were weaponized. The latest Coverity scan for Puppet (3) shows no high impact vulnerabilities. So the result is not surprising.

What is the difference between Puppet and TomCat? Puppet is written in PHP/Python/Ruby with a defect density of 0.20. The defect density is the number of defects in 1000 LoC. TomCat is written in Java with a defect density of 1.19. Thus, software reviews will definitely detect more vulnerabilities in TomCat than in Puppet.

This has direct impact on your security strategy. If you use TomCat as middle-ware in the DMZ you should design your application to allow frequent patching, means, more robust against changes in the middle-ware. In addition, automated testing is required to ensure operability in the case a patch must be implemented. Finally, your operations team must be prepared to install patches within few hours upon release by the vendor.

Have you ever seen such details for commercial software? Like IIS?

Have a great week.


References

1. Cimpanu C. Vulnerabilities in popular open source projects doubled in 2019 [Internet]. ZDNet. 2020 [zitiert 8. Juni 2020]. Available at: https://www.zdnet.com/article/vulnerabilities-in-popular-open-source-projects-doubled-in-2019/

2. Synopsys. Coverity Scan – Static Analysis for Apache TomCat [Internet]. 2020 [zitiert 9. Juni 2020]. Available at: https://scan.coverity.com/projects/apache-tomcat

3. Synopsys. Coverity Scan – Static Analysis for Puppet [Internet]. [zitiert 9. Juni 2020]. Available at: https://scan.coverity.com/projects/puppetlabs-puppet

ComRAT V4 got an upgrade: On the value of Threat Intelligence

30 May 2020

Popular IT security media and threat intelligence services reported this week that the ComRAT V4 malware used by Turla APT got an upgrade. (1)(2)(3)

The big question for all businesses is: Do we have an increased risk resulting from this upgrade? Are the existing security controls still mitigating the risk stemmed from the ComRAT upgrade? Or do we have to upgrade our security controls as well.

The businesses in focus of the Turla APT should answer this question as soon as possible. Detailed information about the feature upgrade as well as the existing security controls are required to answer this question. This is nothing new. “If you know the enemy and know yourself, you need not fear the result of a hundred battles.” says Tzu Sun in the “Art of War” about 500 BC.

Are you prepared to answer this question? Your invest in threat intelligence is uneconomic if you cannot evaluate the threat details in the context of your environment.

What about ComRAT? The way command and control is performed changed. But the primary installation method has not changed: “ComRAT is typically installed via PowerStallion, a lightweight PowerShell backdoor used by Turla to install other backdoors.”(1)

PowerShell 5.0 Icon (5)

PowerShell 5.0 Icon. Picture Credits (5)

So, if you already implemented security controls, that deal with malware which uses PowerShell, your risk will not change. Otherwise, the publication “Securing PowerShell in the Enterprise” (4) of the Australian Cyber Security Center is a good starting point for a systematic approach to PowerShell security.

My advice: Disable PowerShell on all standard user computers. For administrative purposes, use hardened systems without email and internet access and implement PowerShell Endpoints.

Have a great Weekend.


References

  1. Lakshmanan R. New ComRAT Malware Uses Gmail to Receive Commands and Exfiltrate Data [Internet]. The Hacker News. 2020 [zitiert 28. Mai 2020]. Verfügbar unter: https://thehackernews.com/2020/05/gmail-malware-hacker.html

  2. Robinson T. Turla’s ComRAT v4 uses Gmail web UI to receive commands, steal data [Internet]. SC Media. 2020 [zitiert 30. Mai 2020]. Verfügbar unter: https://www.scmagazine.com/home/security-news/malware/turlas-comrat-v4-uses-gmail-web-ui-to-receive-commands-steal-data/

  3. Gatlan S. Russian cyberspies use Gmail to control updated ComRAT malware [Internet]. BleepingComputer. 2020 [zitiert 30. Mai 2020]. Verfügbar unter: https://www.bleepingcomputer.com/news/security/russian-cyberspies-use-gmail-to-control-updated-comrat-malware/

  4. Australian Cyber Security Center. Securing PowerShell in the Enterprise | Cyber.gov.au [Internet]. Australian Signals Directorate. 2019 [zitiert 6. März 2020]. Verfügbar unter: https://www.cyber.gov.au/publications/securing-powershell-in-the-enterprise

Picture credits

  1. PowerShell 5.0 Icon. Microsoft / Public domain. https://commons.wikimedia.org/wiki/File:PowerShell_5.0_icon.png