Keep calm and ignore Illusion Gap

5 October 2017

During a cycling trip through the Eifel national park last week, a new weakness called Illusion Gap was extensively discussed in the media.

Security researchers at CyberArk detected a feature in the Windows SMB Server that allows attackers to bypass Windows Defender, and possibly other anti-malware products, when serving an executable from a file share. For more details please see Kasif Dekel’s excellent post at the CyberArk Threat Research blog.

CyberArk notified Microsoft of this vulnerability, but Microsoft did not view it as a security issue:

“Thanks for your email. Based on your report, successful attack requires a user to run/trust content from an untrusted SMB share backed by a custom server that can change its behavior depending on the access pattern. This doesn’t seem to be a security issue but a feature request which I have forwarded to the engineering group.”

In my opinion, the effort to successfully exploit Illusion Gap appears to be somewhat too high:

First of all, an attacker must convince a user to execute a program that installs a specially crafted SMB server service on a Windows system. Since administrative privileges are required to do this the perfect victim should either work with permanent administrative rights or should at least have access to an administrative account he can leverage for UAC. Finally, the attacker must install a malicious and a clean version of the executable on the newly created file share and trick a user to run the executable from the share.

Since the attack complexity is high and authentication is required the likelihood of rapid detection is high. This is aggravated by the fact that the execution of programs from file shares is often used as indicator of compromise.

With this, we should not waste our time with Illusion Gap.

Have a great weekend.


Critical vulnerabilities require immediate action – How to prevent Equifax like attacks

23 September 2017

Critical Vulnerabilities are

  • exploitable from the network (Access Vector: Network),
  • require only low or medium skills to exploit (Access Complexity: Low or Medium),
  • require no authentication (Authentication: None),
  • cause great damage (Severity: High), and
  • allow remote attackers to execute arbitrary code on the victims’ computer

Among the vulnerabilities with CVSS vector (AV:N/AC:L/Au:N) or (AV:N/AC:M/Au:N) which cause great damage the last property makes the difference.

The infographic below shows that the number of critical vulnerabilities (320) is very small compared to the total number of vulnerabilities in 2016.

Critical Vulnerabilities 2016

Critical vulnerabilities 2016. Click to enlarge.

Nevertheless, immediate action is required because the reach of attacks is technically unlimited if critical vulnerabilities can be exploited.

Once an attacker has exploited a critical vulnerability in the DMZ he is able to execute arbitrary code on this computer. With this, he can probe the network for other computers with critical vulnerabilities or leverage Windows built-in weaknesses, configuration issues, and tools to explore the network until he finally gets to a computer which has a connection across a firewall to the company network.

Both, NotPetya and WannaCry exploited critical vulnerabilities. While WannaCry was just annoying, NotPetya caused multi-million dollar damage in companies across the world.


The TEAM approach for handling risks shows the direction for dealing with critical vulnerabilities.

Transfer: No insurer will take the risk because in the case of a critical vulnerability on a server in the DMZ both the probability of occurrence and the impact are high.

Eliminate: Is not possible, because this will result in loss of business.

Accept: No option because the probability of occurrence and the impact are high.

Mitigate: Patching is the only possible response in this case. Isolation of the system from the network will result in loss of business.


Under normal conditions, patches are available at the time of disclosure.

Rule: Critical vulnerabilities should be patched faster than exploits show up on the market.

With this, immediate action is required because very often exploits are available yet at the time of disclosure. In addition, we cannot expect that only ethical hackers publish vulnerabilities.


Critical Vulnerabilities Mitigation Process

Critical vulnerabilities mitigation process.

In the Equifax attack the critical vulnerability CVE-2017-5638 in the Apache Struts framework was used. A patch was available at the time of disclosure but apparently not applied.

Patching the Apache Struts framework is a challenging job.

Firstly, it is a challenge to identify the systems with the vulnerable framework installed.

Secondly, patches must be carefully tested prior implementation to avoid business loss.

Finally, the patches must be implemented manually because automated patch management is not available.

Thus, an up-to-date asset repository, a current QA system, and actual automated test routines are required to get the job done in the required short time frame.

To be honest, the Equifax attack remains a mystery for me. The IT shop of a billion dollar company should be able to deal with critical vulnerabilities in the required short time. Perhaps someone simply underestimated the risk.

For more details on the Equifax attack see Steven Bellovin’s post Preliminary Thoughts on the Equifax Hack published at CircleID.

Have a great weekend.

A lesson in Phishing and Two Factor Authentication

13 August 2017

The post ‘Hackers Hijack Popular Chrome Extension to Inject Code into Web Developers’ Browsers’ published on August 3, 2017 by Graham CLULEY at the Tripwire blog ‘The State Of Security‘ gives another good reason for the use of Two Factor Authentication.

Since phishing emails become better and better it is not surprising that even professionals can be tricked.

Thus I can fully accept the developer’s answer ‘I stupidly fell for a phishing attack on my Google account.’ to the question ‘Any idea how this could have happened?’.

But I cannot understand why the Google account was not secured with Two Factor Authentication (TFA), in particular because Google’s Push Notification makes life with TFA really easy.

With TFA enabled, this cyber attack could have been prevented.

Have a great week, and activate TFA for your Google account.

Adobe Systems Inc’s Flash will be retired at the end of 2020

30 July 2017

From an IT security point of view, Adobe’s announcement to retire Flash Player at the end of 2020 is excellent news. For details see the report ‘Adobe to pull plug on Flash, ending an era’ published in Reuters Technology News on 25 July 2017.

Flash player was good for a lot of CVSS V2 severity High rated vulnerabilities every year.

Flash Player CVSS Severity High rated vulnerabilities

Flash Player CVSS V2 Severity High rated vulnerabilities

NIST NVD search parameters:  Results Type: Statistics /  Keyword (text search): Adobe flash player /  Publication Start Date: January 2010 / Publication End Date: July 2017 / CVSS Version: 2
CVSS V2 Severity: High (7-10)

The result was an endless stream of patches which kept IT operations groups busy all year.

Thank you, Adobe, for the good news.

Have a great week.

German firms lost millions of euros in ‘CEO Fraud’ scam: BSI

23 July 2017

The report ‘German firms lost millions of euros in ‘CEO Fraud’ scam: BSI’ published in the Reuters Technology News on 10 July 2017 makes me really worry. Whaling, a special form of spear phishing aimed on corporate executives, is not new at all. For some samples see this slide show on

It appears to me that in Germany the first line of defense, the employees, are not adequately prepared in the detection and the correct handling of phishing attacks, even though anti-phishing training is the most effective and cost efficient defensive measure in the fight against all kinds of phishing.

In addition, some rules are helpful and should be communicated to all employees:

  1. Users should never act on a business request from a company executive if the email is not signed with a company owned and valid email certificate.
  2. Users should never trust an email of a business partner if it is not signed with the partners valid email certificate.

Technical implementation is very easy, thus even SMB can use email signing in daily communication.

Have a great week.

Why is the industry such vulnerable against WannaCry and NotPetya style attacks? Part II.

16 July 2017

In part one of this post I discussed the impact of the aging IT infrastructure on the industry’s vulnerability against WannaCry and NotPetya style attacks. Part II deals with the OS basics.

Built-in features of the Windows operating system

Windows is the hacker’s paradise. Not because of the endless stream of vulnerabilities. I my opinion, Microsoft does a good job in managing this.

But because Windows is designed to support the efficient administration of networks with thousands of windows workstations, servers, users and applications.

The authorization subsystem (Active Directory) allows the assignment of fine grained permissions to users and groups to whatever resources, and the authorization check before access to resources in near real-time. It is highly scalable to support a single office LAN as well as a segmented global network.

Built-in utilities like Admin Shares, WMI (Windows Management Instrumentation), netsh, ipconfig, and the net command enable administrators to query and to change workstation, server and user settings across the network and to support efficient software distribution and troubleshooting. Windows Server Update Service (WSUS) supports the administrators in keeping the known vulnerabilities patched.

Everything is of course scriptable with the Windows Command Shell, Powershell and VBScript. All utilities can be leveraged up to a certain extent by every user and fully by administrators.

And of course, also by malware or cyber-criminals. Once a cyber-criminal managed to get on your network with e.g. a RAT (Remote Access Toolkit), he can walk across your network and do his malicious work with just the built-in tools. A download of utilities from a C&C (command and Control) server is not necessary. With this, the cyber-criminal is nearly invisible and he will stay nearly invisible for a long time if he makes no errors.

The Principle of least privilege is implemented in Windows at all levels of the OS stack. This is ensured by the Secure Development Lifecycle (SDL), which is the mandatory Microsoft development policy since 2004. Thus, under normal conditions, the Windows built-in security features would limit the impact of a malware.

Unfortunately, software failures cannot be avoided by the SDL because they are systemic errors – we build them during development right into the software. Once a process state triggers such a systemic error and someone finds a method to reproduce the error condition, the error becomes a vulnerability, e.g. MS017-10. This is no problem unless an exploit is published which allows a cyber-criminal to leverage the vulnerability for e.g. privilege escalation. With this, he gets full access to all the built-in tools and to all processes, including the authorization subsystem.

But even if exploiting a vulnerability leads not to a privilege escalation only some patience is needed. Just probe the network until a user is found who works with permanent administrative privileges. If such a session is hijacked, a cyber-criminal gets full access to all tools and the authorization subsystem on the computer.

With administrative privileges the attacker or malware can dump the authorization subsystem on the computer and extract either the password hashes or the clear text passwords. The example below shows an extract created by MIMIKATZ on a Windows 7 Enterprise Editon Workstation.

C:\Program Files (x86)\mimikatz\x64>mimikatz
.#####.   mimikatz 2.1.1 (x64) built on Jun 18 2017 18:46:28
.## ^ ##.  "A La Vie, A L'Amour"
## / \ ##  /* * *
## \ / ##   Benjamin DELPY `gentilkiwi` ( )
'## v ##'             (oe.eo)
'#####'                                     with 21 modules * * */

Authentication Id : 0 ; 315690 (00000000:0004d12a)
Session           : Interactive from 1
User Name         : kjochem
Domain            : WIN-2OLSA000OLM
Logon Server      : WIN-2OLSA000OLM
Logon Time        : 16.07.2017 21:31:24
SID               : S-1-5-21-3248755352-2707638487-1840279341-1000
msv :
[00000003] Primary
* Username : kjochem
* Domain   : WIN-2OLSA000OLM
* NTLM     : dd94b116548a739e24ad775193c2d13b <--- Password hash
wdigest :
* Username : kjochem
* Domain   : WIN-2OLSA000OLM
* Password : #Not very12strange! <--- Clear text password
kerberos :
* Username : kjochem
* Domain   : WIN-2OLSA000OLM
* Password : (null)
ssp :
credman :

The extracted passwords can be used for direct login to further systems, the password hashes in Pass-the-Hash attacks on further nodes. In any case the chance of detection is low since the attacker behaves like a normal user.

This is the way NotPetya works and other malware worked in the past and will work in future.

Windows is highly optimized to allow cost effective operation of networks of thousands of computers. This leads automatically to misconfigurations, e.g. through domain based technical accounts with high privileges on all workstations and servers. In combination with users working with permanent administrative privileges the cyber criminal’s life is simplified.

What are mitigating measures?

The selection below makes no claim to be complete.

Migration to Windows 10.

Drop all old-style transportation and authentication protocols during this process. Migration to Windows 10 is the first choice because baseline security in Windows 10 is higher than in Windows 7. For example, the issue with the plain text passwords in the authorization subsystem is gone. But this is not helpful in industry because we must deal for at least 5 to 10 years with Windows 7 or Windows 2008 server and old-style protocols.

Short and mid-term mitigation measures.

  • Reduce the number of users working with permanent administrative rights to zero. This is a leadership task!
  • Implement priority patching of critical systems, especially for those on the perimeter to the production networks.
  • Review all firewall rules. Focus on required connections, limit the use of the SMB protocol as far as possible.
  • Review all technical users. Limit their functionality to the local systems and lowest possible privileges, if possible.
  • Roll out a security incident detection tool (SIEM) to all clients and servers. For example, dumping of processes in memory of a workstation or server is a clear indicator for a hacking attempt. Immediate action upon such events is required.
  • Implement privileged account and session management, in the best case with one-time passwords which are changed after the session ends.
  • Apply the measures to mitigate Pass-the-Hash attacks to all Windows networks. For details please see

Long-term measures.

  • Microsoft should build a production friendly Windows with limited functionality. This Windows should have a much smaller attack surface than the standard multi-purpose Windows systems of today.
  • The dependency on the SMB protocol for exchange of data between the office and the production networks should be reduced, in the best case to zero.

Have a great week!

Why is the industry such vulnerable against WannaCry and NotPetya style attacks? Part I

9 July 2017

“Germany’s BSI federal cyber agency said on Friday that the threat posed to German firms by recent cyber attacks launched via a Ukrainian auditing software was greater than expected, and some German firms had seen production halted for over a week.” The report “Germany says cyber threat greater than expected, more firms affected” published in the Reuters Technology News on 7 July 2017 is worth reading.

But the big question is: Why is the industry such vulnerable against WannaCry and NotPetya style attacks?

In my opinion, the main reasons for this are

  • the aging IT infrastructure, and
  • the built-in features of the Windows operating system.

Aging IT infrastructure

SMB Version Introduced with Version Year of Release
V1.0 Windows 2000 2000
Windows XP / 2003 Server 2001 / 2003
V2.0 Windows Vista / 2008 Server 2007 / 2008
Windows 7 / 2008 Server R2 2009
V3.0 Windows 8 / 2012 Server 2012
Windows 10 / 2016 Server 2015 / 2016

Table 1: SMB Versions

The source of today’s problems, SMB V1.0, was introduced with Windows 2000. With the end of the extended support for Windows XP on 8 April 2014, and Windows 2003 Server on 14 July 2015, Windows XP/2003 Server became a big security issue.

Nevertheless, systems with XP or Windows 2003 Server are still operated in data centers and industrial networks. Since these systems must exchange data with other Windows-based systems, SMB V1.0 cannot be just switched off. Even Windows systems which support SMB V2.0 or higher must allow SMB V1.0 for data exchange with older versions.

The big question is: Why takes it so long to shut down Windows XP/2003 Server? The answer is easy: Software and hardware manufacturers have not sufficiently cared about the software life cycle, at least in the past. Let me illustrate this with an example.

A package unit in Healthcare industry is a large machine with lots of inbuilt computers. Since package units are very expensive, they are operated for many years and extensively changed to support new products. With this, a package unit delivered in 2008 with embedded Windows XP control units may still be in use 24 hours a day in 2017.

The hardware of the computers is designed to control a high-speed packaging process. To ensure sustained high operational quality the manufacturer often allows neither the installation of anti-malware software nor service packs for the OS, not to mention the upgrade to newer versions of the Windows OS.

Since the MES (Manufacturing Execution System) copies files to and from the packaging unit through files shares on the embedded Windows XP control stations, the MES must communicate through the SMB V1.0 protocol. The same is true for computers used in remote maintenance. With this, a single Windows XP machine reduces the security level of an entire network.

The big challenge is to design maintenance-friendly industrial computer systems: An exchange of hardware and software components, which are near End-of-Life or which have reached technical limits, must be easily possible. This requires a change in the design of software in industry. In addition, hardware should be dimensioned such that basic security features like anti-malware protection could be operated.

Manufacturers were often not aware of the software lifecycle and its impact on cyber security and integrity of product and production in the past. A change is desperately needed, in particular with regards to the increased use of IIoT devices.

Have a great week.