homepage
Open menu

SANS NewsBites

Exploit Code Released for Critical Cryptographic Flaw in Windows; The U.S. National Cybersecurity Talent Discovery Program; Russian Hackers Breached Ukrainian Gas Company

January 17, 2020  |  Volume XXII - Issue #5

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-01-16

Proof-of-Concept Exploit Code Released for Critical Cryptographic Flaw in Windows 10

The US National Security Agency (NSA) has deemed a cryptographic flaw it found in Windows 10 so critical that it took the unusual step of disclosing the flaw itself. The flaw could be exploited to spoof code signing certificates. The issue also affects Windows Server 2016 and 2019 and "applications that rely on Windows for trust functionality." The Department of Homeland Security's (DHS's) Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive instructing federal agencies to patch the issue by January 29. Proof-of-concept exploit code for the vulnerability has been released.

Editor's Note

SANS created a test site at https://curveballtest.com. The site also offers a benign executable that was signed with an exploit signature. Use it to test your defenses. Many end point protection products and even Chrome have added rules to detect bad signatures, possibly protecting you even if you are not yet patched.

Johannes Ullrich
Johannes Ullrich

2020-01-14

Microsoft Patch Tuesday

On Tuesday, January 14, Microsoft released fixes for 50 security issues, including a critical cryptographic vulnerability in Windows 10. While that vulnerability has grabbed headlines, users are also being urged to apply the update to fix a pair of Remote Desktop Protocol (RDP) vulnerabilities. January 14 also marks the last update Microsoft will provide for Windows 7; the operating system will no longer be supported for home users.

Editor's Note

Do not overlook the RD Gateway issues (CVE-2020-0609 and CVE-2020-0610). These are critical and on the same level as the famous "BlueKeep" vulnerability in RDP if you are using RD Gateway.

Johannes Ullrich
Johannes Ullrich

DHS/CISA considers these vulnerabilities severe enough to have issued Emergency Directive 20-02 (https://cyber.dhs.gov/ed/20-02/) which requires federal agencies to apply these patches within ten business days (1/29/20) as well as report progress on applying the fixes. DHS's last emergency directive was ED 19-01 (Jan. 22, 2019) to "Mitigate DNS Infrastructure Tampering." It is expected that products that leverage the Microsoft crypto library, or otherwise use or implement ECC should be checked for similar flaws. Vendors are starting to publish their assessments.

Lee Neely
Lee Neely

2020-01-17

The U.S. National High School Cybersecurity Talent Discovery Program

The U.S. National high school cybersecurity talent discovery program (an extracurricular program) has 6,669 high school girls participating in just the first four days of the multi-week program. Texas, New Jersey and Nevada are leading the nation with Maryland and Virginia rounding out the top 5. In all those states and in 22 more, governors personally invited students to "just try it." California seems to be gaining momentum - reflecting Cisco's initiatives to encourage employees to get the word out and help high school teams. Playing the game doubles the likelihood that a young woman will be interested in pursuing computer science. And students learn far more while playing than in any other cybersecurity competition and in fact more than in most high school or college cybersecurity classes.

Editor's Note

Boys also get to play in every school where five or more girls are making progress.

Alan Paller
Alan Paller

Read more in

2020-01-16

Report: Russian Hackers Breached Systems at Ukrainian Gas Company Burisma

According to a report from security company Area 1, Russian hackers successfully targeted systems at Ukrainian gas company Burisma through phishing attacks late last year. The attacks appear to be an effort to obtain potentially embarrassing information to be used against Joe Biden. Biden's son once served on Burisma's board of directors. Ukraine's Ministry of Internal Affairs has begun criminal proceedings in connection with the attacks, and is reportedly seeking help from the FBI.

The Rest of the Week's News

2020-01-15

Adobe Patch Tuesday

Adobe's monthly security release includes fixes for five critical memory corruption flaws in Illustrator CC and four flaws in Adobe Experience Manager.

Editor's Note

The good news is Adobe's creative cloud desktop service by default will automatically apply these patches and are fixes specific to their Illustrator and Experience Manager products which are typically not as widely deployed as Acrobat or Flash in the enterprise, so ensuring they are mitigated should be much easier.

Lee Neely
Lee Neely

2020-01-15

Oracle Critical Patch Update for January 2020

Oracle's Critical Patch Update for January 2020 includes fixes for 334 security issues across a wide spectrum of product families. Forty-three of the vulnerabilities addressed in the update are rated critical.

Editor's Note

The WebLogic and Peoplesoft flaws are my main concern. We have seen similar flaws exploited in the wild before. It is a bit disappointing that Oracle still patches two year old flaws in open source libraries like Apache Commons and log4j.

Johannes Ullrich
Johannes Ullrich

The large number here is due to the breadth of products included in the patch bundle which includes 10 Solaris fixes, 38 Fusion Middleware fixes, 23 for the E-Business suite and 12 for their database server. The urgency of the update is due to 191 fixes for flaws that can be remotely executed without authentication. When pared down to products running in your environment, the number is much more manageable. Even so, timely regression testing and application is prudent, particularly for externally accessible services.

Lee Neely
Lee Neely

2020-01-16

Android Mobile App Data Sharing is "Out of Control"

A report from the Norwegian Consumer Council says that the sharing of sensitive information by Android apps is "out of control." According to analysis of 10 popular Android apps conducted by Mnemonic, the apps share sensitive user data with numerous third-parties. Mnemonic conducted its analyses between June and November 2019. In all, the 10 examined apps sent user data to a total of 135 separate third-party entities that all engage in advertising or behavioral marketing.

Editor's Note

At the same time, users are complaining that the latest iOS release from Apple is "too noisy" with its location tracking alerts. In the end, many people just want things to work and don't care who they are sharing what information with.

Johannes Ullrich
Johannes Ullrich

For many applications, enabling access to sensitive data is needed for desired functionality. Even so, in current Android operating systems, you can now review application privileges and ensure that you've not granted extra permissions in the heat of installing a new app. While reading the privacy/data sharing agreements is a good way to find out where a given application will share data, providers need to make sure they are short, easy to understand, and quick to read so users will look at them.

Lee Neely
Lee Neely

2020-01-16

P&N Bank Discloses Breach

Australia's P&N Bank has disclosed a breach that compromised customer data, including names, account numbers, and account balances. The incident occurred around the second week of December 2019 during a server upgrade. P&N believes that the intruders gained entry through third-party hosting provider.

2020-01-15

Users Urged to Patch Cisco Data Center Network Manager Vulnerabilities

Cisco released fixes for a trio of critical flaws in its Data Center Network Manager software earlier this month. Users are urged to apply the patches as soon as possible because proof-of-concept exploit code has been released.

2020-01-15

WordPress Plugin Flaws Affect 320,000 Sites

Critical flaws in two WordPress plugins could be exploited to access websites' administrator accounts without a password. The affected plugins - InfiniteWP Client and WP Time Capsule, run on 300,000 and 20,000 websites, respectively. The developers of both plugins have addressed the issues in updates.

Editor's Note

WordPress just can't get its act together. There are two ways to run WordPress: Either you run it at WordPress.com and pay, or you don't run it. WordPress's business model is based on the fact that the only way to run its product securely is if you let them manage it for you.

Johannes Ullrich
Johannes Ullrich

Automating plugin updates for CMS systems prevents more problems than it creates. Coupled with incremental backups which permit easy roll-back, the risks are largely mitigated. Reviewing and removing unused plugins regularly is also prudent.

Lee Neely
Lee Neely

2020-01-14

Alleged Swatter Arrested

US federal authorities have arrested a Virginia man for his alleged involvement with a neo-Nazi group that launched swatting attacks and bomb threats against hundreds of targets. John William Kirby Kelley was identified after he phoned in a bomb threat to Old Dominion University in November 2018, while he was a student there. Two other individuals involved in the attacks remain at large.

2020-01-14

Ryuk Ransomware Tries to Wake Powered-Down Devices

Ryuk Ransomware is capable of using the Wake-on-LAN feature to cause devices in standby state to turn on so it can attempt to encrypt them. The Wake-on-LAN feature allows devices that have been powered down to be woken up by sending a special network packet. Administrators are advised to restrict Wake-on-LAN packet permissions. Researchers at CrowdStrike noted this capability in November 2019.

Editor's Note

Wake-on-Lan needs to be activated from the local subnet and is more likely used on workstations and desktops than servers which run continuously. Apply filters to only allow Wake-on-Lan packets from authorized devices. Also check for permissions on shares, which is how the Ransomware is attempting to access and encrypt awakened systems.

Lee Neely
Lee Neely

2020-01-16

FBI Changes Breach Notification Policy for Election Systems

The FBI will now notify state officials when election systems within their states have been breached in a cyber attack. Previously, the FBI notified only affected counties. (Please note that the WSJ story is behind a paywall.)

Internet Storm Center Tech Corner

Microsoft January 2020 Patch Tuesday and #CryptoAPI Flaw

Webcast: https://sans.org/cryptoapi-isc

Diary: https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+for+January+2020/25710/

NSA Release: https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF


CVE-2020-0601 Followup

https://isc.sans.edu/forums/diary/CVE20200601+Followup/25714/


CVE-2020-0601 Update ("Curveball", "Letsdecrypt")

https://isc.sans.edu/forums/diary/Summing+up+CVE20200601+or+the+Lets+Decrypt+vulnerability/25720/

https://curveballtest.com


Oracle Patches

https://www.oracle.com/security-alerts/cpujan2020.html


Certain Netscaler Devices Do Not Support Mitigation (article in Dutch)

https://www.ncsc.nl/actueel/nieuws/2020/januari/16/door-citrix-geadviseerde-mitigerende-maatregelen-niet-altijd-effectief


Cable Haunt Vulnerability

https://cablehaunt.com/


STI Student Interview: Jon Michael Lacek

https://www.sans.org/reading-room/whitepapers/securecode/changing-devops-culture-security-scan-time-39125