Two Big Cyber Takedowns and the New NSA

This is a "tip of the iceberg" story. Paul Nakasone, and the extraordinarily capable leadership team he assembled, created a new NSA that is making a quiet but powerful difference on both the defensive and offensive side of cybersecurity. Both directly and through partnerships with DHS and other organizations, this is the NSA and Cyber Command we always hoped would emerge. Garrett Graff published an insightful review of Gen. Nakasone and his accomplishments in Wired on Monday: https://www.wired.com/story/general-paul-nakasone-cyber-command-nsa/: The Man Who Speaks Softly--and Commands a Big Cyber Army

Alan Paller

Beyond demonstrating the capability of US Cyber Command, this also reveals the recovery capabilities of the TrickBot botnet which will help with the eventual takedown. TrickBot uses Tor to obfuscate C&C servers as well as EmerDNS to register backup servers for fail-over. While it's not clear if a military response was appropriate, statements by Microsoft (www.nytimes.com/2020/10/12/us/politics/election-hacking-microsoft.html: Microsoft Takes Down a Risk to the Election, and Finds the U.S. Doing the Same) and Cyber Command (https://www.washingtonpost.com/national-security/cyber-command-trickbot-disrupt/2020/10/09/19587aae-0a32-11eb-a166-dc429b380d10_story.html: Cyber Command has sought to disrupt the world's largest botnet, hoping to reduce its potential impact on the election) support the actions to include election security concerns.

Lee Neely

In the legal filing, Microsoft argued that Trickbot irreparably harms the company "by damaging its reputation, brands, and customer goodwill." In essence, the TrickBot behavior leads users to believe they are seeing intended actions in the Microsoft product. Brian Krebs provides detailed analysis of the case. https://krebsonsecurity.com/2020/10/microsoft-uses-copyright-law-to-disrupt-trickbot-botnet/: Microsoft Uses Trademark Law to Disrupt Trickbot Botnet

Lee Neely

The legal basis for this takedown is arguable; the bad guys are unlikely to come into court to argue their case. Enterprise applications should be as resilient as this botnet.

William Hugh Murray

While the authority of the NY DFS is limited to enterprises that are licensed or chartered by the state of New York, all enterprises can and should operate consistent with their reasonable and useful requirements. The large states are playing a useful role in defining standards of care. In some cases, the states have asserted their authority beyond enterprises that they "license or charter" to those that "operate or offer services in."

William Hugh Murray

Kudos to Zoom for delivering the solution so rapidly. The primary difference here is where encryption keys are generated and who can decrypt the content. In short, with E2EE, the meeting host generates the key and uses PKI to transmit them to participants, while previously the Zoom server generated and transmitted those keys, which meant that Zoom could share them with supporting services such as meeting transcription and live streaming which need decrypted content. Several features are disabled with E2EE such as join before host, breakout rooms, cloud recording and transcription. Read Zoom's FAQs on their blog below to see all the impacts.

Lee Neely

The exploit leverages a use-after-free condition to cause malicious code to be executed. The updates address CVE-2020-26534, CVE-2020-26535, CVE-2020-26537 and CVE-2020-26539. The Windows update was released September 28th, Mac version October 9th. The CVSS 3.x scores are 9.8, indicating rapid update is prudent.

Lee Neely

Barnes & Noble believes the attack was due to an intrusion, rather than ransomware, possibly leveraging a previously identified flaw in their VPN servers (CVE-2019-11510). Be sure to not only monitor for inappropriate system access, but also mitigate or remediate flaws in boundary protection devices expeditiously.

Lee Neely

A lot has been written about the ICMPv6 "Bad Neighbor" vulnerability. While the flaw is pretty straight-forward, exploitation isn't quite as easy, and calling the vulnerability "wormable", while technically correct, is a bit of a stretch. In order to exploit the vulnerability, an attacker has to be on the same network segment as the victim. A worm would only spread in one network segment as the packets are not routable. Remote code execution will also require an information disclosure vulnerability in addition to this code execution vulnerability. If an attacker has a foothold in your network, there are probably a dozen easier to exploit vulnerabilities. https://isc.sans.edu/forums/diary/CVE202016898+Windows+ICMPv6+Router+Advertisement+RRDNS+Option+Remote+Code+Execution+Vulnerability/26684/: CVE-2020-16898: Windows ICMPv6 Router Advertisement RRDNS Option Remote Code Execution Vulnerability

Johannes Ullrich

Adobe Flash support will be ending this year. As part of this latest update, Adobe will also suggest uninstalling Flash. Please follow Adobe's advice.

Johannes Ullrich

Fixes to Chrome and Microsoft Edge are included in their latest updates. Verify Flash update status via chrome://components and edge://components functions. Better still, disable Flash where not needed.

Lee Neely