Category Archives: Survival tips

Critical Wormable Vulnerability CVE-2019-0708 patched. Is the world a safer place now?

19 May 2019

Microsoft released (1) a patch for the critical Remote Code Execution vulnerability CVE-2019-0708 (2) in Remote Desktop Services on May 14th, 2019. The vulnerability is wormable. A malware that exploits the vulnerability can spread from vulnerable computer to vulnerable computer in a way WannaCry did in 2017. Fortunately, only Windows XP, Windows 2003 Server, Windows 7 and Windows 2008 Server are impacted.

How big is the problem?

A Shodan search shows that about 30% of the Windows 2008 server systems directly connected to the internet are impacted. The Windows 2003 problem is much larger although Microsoft stopped the extended support for this version in July 2015.

Table 1: CVE-2019-0708 Impacted Systems. Source: Shodan. Data generated: 5/19/2019 7:30 pm

How to mitigate?

Since CVE-2019-0708 is a remote code execution vulnerability patches or other mitigating measures should be applied directly.

Microsoft provided patches with the May 2019 patch set, even for Windows 2003 Server and Windows XP, to prevent similar effects to that of WannaCry on the global economy. As an immediate step, Microsoft recommends deactivating RDP access to the impacted systems.

Is the world a safer place now?

Far from it. A brief analysis shows that many of the impacted systems provide applications based on a WAMP technology stack (Windows, Apache, MySQL, PHP). And in many cases remote code execution vulnerabilities in Apache or PHP are not patched. With this, the overall security level remains as bad as before Microsoft released the patches.

Without vulnerability and application life cycle management such problems cannot be solved. Apache, MySQL and PHP can be operated on top of an outdated Windows OS, but critical vulnerabilities in these components must be patched directly to avoid a large financial impact in the worst case.

The Equifax data breach from 2017 is just one example. In this case an unpatched remote code execution vulnerability in the Apache Struts framework opened the door for the attackers. Equifax (3) estimates that it has spent $1.4 billion so far to recover from the breach.

Have a great week.


References

  1. MSRC Team. Prevent a worm by updating Remote Desktop Services (CVE-2019-0708) – MSRC [Internet]. 2019 [cited 2019 May 19]. Available from: https://blogs.technet.microsoft.com/msrc/2019/05/14/prevent-a-worm-by-updating-remote-desktop-services-cve-2019-0708/
  2. NIST NVD. NVD – CVE-2019-0708 [Internet]. 2019 [cited 2019 May 19]. Available from: https://nvd.nist.gov/vuln/detail/CVE-2019-0708
  3. Olenick D. Equifax data breach recovery costs pass $1 billion [Internet]. SC Media. 2019 [cited 2019 May 19]. Available from: https://www.scmagazine.com/home/security-news/data-breach/equifax-data-breach-recovery-costs-pass-1-billion/
Advertisements

The Costs of Doing Application Life Cycle Management Not Right

12 May 2019

For the following text, let us assume that we created a fictional application named Our Awesome App (OAA) on the basis of the Microsoft technology stack. OOA runs on top of the Windows 2008 R2 Server OS. Microsoft stops the support for this version in January 2020, thus we may have some migrations to do.

What is application lifecycle management?

Application lifecycle management (ALM) is a continuous process of managing the life of an application through governance, development and maintenance.”(1)

I prefer this brief definition of ALM of 2010 although the current Wikipedia definition(2) is more comprehensive.

It is the restriction to applications that creates the trouble in both definitions because applications are bound to a Web or Technology Stack.(3)

Technology Stack

Technology Stack

Each product in the technology stack has a life cycle, usually independent of the life cycle of the other layers and of OAA. With this, application life cycle management cannot be considered independently from the technology stack. Even if no development takes place on the application layer, changes in the technology stack might demand changes in the application.

Usually, ALM deals with Layers 1 to 4 of the technology stack. Neither the database nor the server is in focus of ALM. For the LAMP (Linux, Apache, MySQL, PHP) stack, this creates no big trouble because the middleware (Apache) and the database (MySQL) are largely immune to changes in the Linux OS.

Microsoft Technology Stack

Microsoft Technology Stack

But in the case of OAA we face some trouble because the Internet Information Server (IIS 7.5) is a component of the Windows 2008 R2 Server OS. A change in the server OS might have a great impact on the application.

What’s the trouble with the Windows 2008 R2 Server end of life?

Every day new vulnerabilities in IT products are published. All layers in the technology stack are impacted. The Windows update service takes care that newly detected vulnerabilities on layers 2 – 5 are automatically patched because we built OAA on top of the Microsoft technology stack. So, the application manager has to deal only with vulnerabilities in OAA.

Microsoft provides no longer patches once a product goes beyond the end of its life. But new vulnerabilities for such products are still discovered and published. This increases the number of unpatched vulnerabilities on the server and middleware layer. With this, the security level of the whole network is lowered because unpatched Windows systems facilitate, in the worst case, the propagation of malware like WannaCry or NotPetya.

What’s the trouble with application life cycle management?

ALM is a tedious and costly task. Getting ALM right requires continuous study of the life cycle of all products on the technology stack and continuous planning, development, integration and testing across all layers of the application stack. Therefore, application managers care often only of the first layer. Developers are responsible for the second, the third and to some extend also for the fourth layer. Someone from IT operations takes care of layers 4 to 6, but no one cares of the entire technology stack.

Eventually, someone realises that some hundred Windows 2008 R2 Servers are still in operation, and only few months left for migration. Migration of applications including the middleware is a lengthy process. Thus, it is obvious to spend some money for extended support, just to buy time to get the migrations done.

What are the costs for extended support?

For the following calculation, let us assume that 20 Windows 2008 R2 servers running the Datacenter Edition and 400 servers running the Standard Edition are still in use. The price for extended on-premise support is at 75% annually of the full license price of the latest Windows server version, provided either software assurance or a subscription is available.(4) Let us assume that the IT team works hard on the migrations and the number of servers to go is reduced every year.

A brief sample calculation based on the regular price sheet(5) shows that a large amount of money is spent just for some security patches.

Sample Windows 2008 Server Extended Support Calculation

Sample Windows 2008 Server Extended Support Calculation

It is very important to note that these expenses are unplanned costs. They reduce the company’s earnings. Fortunately, this cost can be avoided if ALM is extended to the whole technology stack.

How to tackle the application life cycle management challenge?

(1) Move the accountability for ALM to the board.

The board is accountable for revenues and earnings. Since unplanned expenses for ALM lower the earnings the CFO should take control.

(2) Embed ALM in your daily business.

ALM is no project. It is a continuous activity that requires coordinated planning across all stakeholders in the business and IT groups. The application development budget should be extended to cover cost caused by changes in the technology stack.

(3) Start early, at least 2 years before the end of life of a product.

Minimize down times to keep the users happy.

(4) Set up and maintain an asset repository.

The asset repository should provide details on the technology stack of each application and the interfaces between applications. Is the repository up-to-date it takes only few minutes to become an idea of the effort related with the next life cycle change.

(5) Develop a concept for applications that cannot be migrated.

In some application areas, such as manufacturing, it is often not possible to migrate to newer versions in due time, for example due to technical restrictions by the vendor. For these applications, concepts must be developed to ensure secure operations beyond the end of life of tech stack components.

(6) Develop an application design guide to simplify ALM and security operations.

Applications should be developed such that they are to a large extent immune against changes in the technology stack. Procurement should take care that off-the-shelf solutions comply to the guidelines.

(7) Foster the change towards DevOps in the IT organisation.

DevOps teams should be responsible for the entire technology stack. At least the testing process should be automated. This will speed-up the roll out of security patches as well.

By the way, Microsoft announced the end of life of Windows 2012 R2 Server for 2023. This change will also affect the whole technology stack, thus start at least in 2021 with preparations.

Have a great week.


References

1. Appelo J. Agile Application Lifecycle Management (ALM) [Internet]. Business presented at; 2010 Nov 22 [cited 2019 May 7]. Available from: https://de.slideshare.net/jurgenappelo/agile-alm

2. Application lifecycle management. In: Wikipedia [Internet]. 2019 [cited 2019 May 7]. Available from: https://en.wikipedia.org/w/index.php?title=Application_lifecycle_management&oldid=895749396

3. Rouse M. What is Web stack? – Definition from WhatIs.com [Internet]. WhatIs.com. 2012 [cited 2019 Apr 29]. Available from: https://whatis.techtarget.com/definition/Web-stack

4. Microsoft. Extended Security Updates for Windows Server 2008 and SQL Server 2008 End of Service FAQ [Internet]. 2019. Available from: https://download.microsoft.com/download/C/8/5/C851D4E2-ED1F-4F56-AEC0-1561D85AB489/Extended_Security_Updates_for_Windows_Server_2008_and_SQL_Server_2008_End_of_Service_FAQ.pdf

5. Microsoft. Windows Server 2019 Licensing & Pricing | Microsoft [Internet]. Microsoft Cloud-Platform – US (English). [cited 2019 Apr 29]. Available from: https://www.microsoft.com/en-us/cloud-platform/windows-server-pricing

Email Data Breach Exposes Over Two Billion Personal Records – Has Cyber Security failed?

20 April 2019

Scott Ikeda’s report(1) on the Verifications.io data breach makes one thing clear: The incurable disease named cyber-security carelessness that leads inevitably to data breaches caused also this incident.

First of all, the company misjudged the criticality of the data. Although the exposed information is publicly accessible the compilation in few data sets simplifies the job of cyber criminals. Phishing emails are just more credible if high quality data(1) is used.

Secondly, the information in the MongoDB was accessible for everyone with internet access. This is not an isolated case. As of today, about 64,000 MongoDB(2) are visible in the internet, thereof about 18,000 with authentication not enabled.

MongoDB accessible to the internet.

MongoDB accessible to the internet.

The system developers ignored the vendors security advice provided in section ‘Limit Network Exposure’ of the MongoDB security checklist(3):

“Ensure that MongoDB runs in a trusted network environment and limit the interfaces on which MongoDB instances listen for incoming connections. Allow only trusted clients to access the network interfaces and ports on which MongoDB instances are available.”

This is easy to implement, at low cost.

Cyber security is about people, processes and technology. In this case, lack of cyber security awareness and missing security processes caused the incident. Nevertheless, security solution vendors advice(1) to implement new security technology for preventing such incidents:

“Security tools that automatically protect your data such as data loss prevention (DLP) and digital rights management (DRM) help secure your sensitive information. In the event that an important cloud vendor doesn’t have the right data protection, you can wrap their applications with a cloud security broker to provide the necessary cloud security and protection for your data.”

The big question is: Are such solutions effectively mitigating the risk if the system is accessible from the internet, without authentication?

I very much doubt because the number and extent of data breaches is continually growing, despite annually increasing investments into cyber security. Technology does just not cure cyber-security carelessness.

Have a great weekend.


References

  1. Ikeda S. Largest Leak in History: Email Data Breach Exposes Over Two Billion Personal Records [Internet]. CPO Magazine. 2019 [cited 2019 Apr 14]. Available from: https://www.cpomagazine.com/cyber-security/largest-leak-in-history-email-data-breach-exposes-over-two-billion-personal-records/

  2. The Shadowserver Foundation. The Shadowserver Foundation: MongoDB NoSQL Server Scanning Project [Internet]. 2019 [cited 2019 Apr 19]. Available from: https://mongodbscan.shadowserver.org/

  3. mongoDB. Security Checklist — MongoDB Manual [Internet]. https://github.com/mongodb/docs/blob/v4.0/source/administration/security-checklist.txt. [cited 2019 Apr 19]. Available from: https://docs.mongodb.com/manual/administration/security-checklist

Petition 89913: Generelles Tempolimit von 130 km/h auf deutschen Autobahnen

17. März 2019

Im WEF Global Risk Report 2019 wird das Risiko Failure of climate-change mitigation and adaption unter den Top 5 Risiken sowohl bei Eintrittswahrscheinlichheit als auch bei Auswirkung an Position 2 gesehen, vor dem Risiko Cyber-Attacks.

We need change!

We need change!

Tempo 130 auf deutschen Autobahnen kann einen Beitrag zur Erreichung der CO2-Einsparungsziele Deutschlands leisten. Diese Maßnahme ist sofort wirksam, mit geringen Implementierungskosten verbunden und hat keine Auswirkungen auf die vernetzte Logistik in Deutschland und Europa. Wer kann das von einer Maßnahme im IT-Security Umfeld sagen?

Bitte helfen Sie mit. Unterstützen Sie die Petition 89913: Straßenverkehrs-Ordnung – Generelles Tempolimit von 130 km/h auf deutschen Autobahnen. Details hier: https://epetitionen.bundestag.de/petitionen/_2019/_01/_09/Petition_89913.nc.html

Vielen Dank!

SpeakUp – Lateral movement made easy

10 March 2019

A remote command-injection vulnerability dubbed SpeakUp (CVE-2018-20062) (1) in the ThinkPHP development framework was widely reported in the news some weeks ago. Technically, SpeakUp is simply one more command-injection vulnerability with CVSS V3.0 base score Critical that results in full loss of integrity if exploited.

CVE-2018-20062 alike Vulnerabilities 2018

CVE-2018-20062 alike Vulnerabilities 2018

CVE-2018-20062-class vulnerabilities are quite rare. As of 10 March 2019 only 182 of the 16517 vulnerabilities published in 2018 belong to this class. Exploitation of any of these vulnerabilities results in full loss of integrity of the attacked system. In the worst case, the compromised system becomes the new base of operations for the attacker and allows him to compromise further systems.

Tara Seals provides a brief outline (2) on ThreatPost of the initial infection routine. For more details see the Checkpoint Research report (3) about SpeakUp.

Lateral movement in Linux-based networks places special challenges on the attacker. In general, vulnerabilities in applications must be used for propagation. SpeakUp uses an impressive arsenal of old vulnerabilities in application frameworks for propagation. Seals writes:

“To spread, SpeakUp’s propagation code exploits known vulnerabilities in six different Linux distributions, including JBoss Enterprise Application Platform security bypass vulnerabilities (CVE-2012-0874); a JBoss Seam Framework remote code execution (RCE) flaw (CVE-2010-1871); a JBoss AS 3/4/5/6 RCE exploit; a Oracle WebLogic wls-wsat Component Deserialization RCE (CVE-2017-10271); a vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (CVE-2018-2894); a Hadoop YARN ResourceManager command-execution exploit; and an Apache ActiveMQ Fileserver File Upload RCE vulnerability (CVE-2016-3088).”

The table below shows some details of the above mentioned vulnerabilities.

CVE

Application Framework

CVSS Base Score

Attack Vector

CVE-2012-0874

JBoss Enterprise Application Platform (EAP)

6.8 (CVSS v2.0)

V:N/AC:M/Au:N/C:P/I:P/A:P (CVSS v2.0)

CVE-2010-1871

JBoss Enterprise Application Platform (EAP)

6.8 (CVSS v2.0)

(AV:N/AC:M/Au:N/C:P/I:P/A:P) (CVSS v2.0)

CVE-2017-10271

Oracle WebLogic Server

7.5 (CVSS v3.0)

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS v3.0)

CVE-2018-2894

Oracle WebLogic Server

9.8 (CVSS v3.0)

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS v3.0)

CVE-2016-3088

Fileserver web application in Apache ActiveMQ

9.8 (CVSS v3.0)

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS v3.0)

Any of the listed vulnerabilities enables the attacker to create new operations bases. In the worst case, he can jump across network boundaries, e.g. from the DMZ into the company intranet or from the company intranet into the production network.

How to stop this kind of attacks?

From the tactical point of view, vulnerability management is the key to stop this kind of attacks as early as possible. CVE-2018-20062-class vulnerabilities and remote code or script execution vulnerabilities must be patched directly after they show up on the market. At least in the DMZ and on systems on both sides of network boundaries. This will prevent the attacker from lateral movement.

Vulnerability management relies on asset management. And on CI/CD across the entire application stack because without automated testing it is not possible to make sure that the application is still working after the patches have been applied.

From a strategic point of view, measures must be applied to enlarge the resilience of application systems against cyber attacks. This includes e.g. micro segmentation or Web Application Firewalls but also Linux native enhancements like AppArmor or SELinux.

And this holds for both, cloud and on-premise hosted applications.

Have a great week.


References

1. NIST NVD. NVD – CVE-2018-20062 [Internet]. 2018 [cited 2019 Feb 6]. Available from: https://nvd.nist.gov/vuln/detail/CVE-2018-20062

2. Seals T. SpeakUp Linux Backdoor Sets Up for Major Attack [Internet]. threatpost. 2019 [cited 2019 Feb 6]. Available from: https://threatpost.com/speakup-linux-backdoor/141431/

3. Check Point Research. SpeakUp: A New Undetected Backdoor Linux Trojan [Internet]. Check Point Research. 2019 [cited 2019 Feb 6]. Available from: https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/


 

The 5G security debate in Germany gains momentum

2 February 2019

Report ‘Deutsche Telekom proposes steps to make 5G safe as Huawei debate rages’ (1) published on January 30, 2019 by Reuters Technology News makes clear that at least the German government and the Deutsche Telekom started to discuss 5G security issues.

“Deutsche Telekom takes the global debate on the security of network equipment from Chinese providers very seriously,” the company said in a statement that spelled out three confidence-building measures.

The company, which is nearly one-third state owned, proposed that all critical infrastructure should be independently certified before deployment by an independent laboratory under state oversight.”

That sounds good.

“It also called for network equipment makers to submit the source code that runs their equipment to a trusted third party. Under certain circumstances, an operator would be able to gain access to address any security vulnerabilities.”

From my point of view, this is not sufficient to increase trust in Huawei’s hard- and software. Moreover, it is also not enough to investigate Huawei hardware and software only. If it comes to matters of national security we should trust no network equipment supplier.

Hardware and source code of all vendors must be verified by an independent organization. Only verified hard and software versions are approved for installation and operations. In addition, a technical testing organization must oversee the installation of hardware and software to make sure that only verified components are installed.

I strongly recommend that the German government should found an independent firm for certifying the software and hardware of any network equipment supplier involved. A trusted German partner should hold a share of at least 51% in this company. Goal of this company is not spying on the suppliers know how, but to create trust in a critical infrastructure.

View on Saargau

View on Saargau from 49.596700, 6.618173

Without trust in the 5G network infrastructure, service providers will not take full advantage of the technology. This will throw back the digitalization in Germany, and thus the German economics, by years. Internet access with 2 MBit/s, the standard in the rural German area Saargau, is definitely not enough to be competitive in the long-term, not to mention for self-driving cars or remote surgery.

Enjoy the view on Saargau.


References

1. Busvine D, Rinke A. Deutsche Telekom proposes steps to make 5G safe as Huawei debate rages. Reuters [Internet]. 2019 Jan 30 [cited 2019 Feb 2]; Available from: https://www.reuters.com/article/us-usa-europe-huawei-tech-deutsche-telek-idUSKCN1PO26K