Microsoft Vulnerability Tuesday Includes Patch for Wormable Flaw; Recent Events Raise Risks of Attacks from Russian Hackers; Prioritize Mitigating Microsoft Windows RDP Vulnerability

This is the second wormable vulnerability in http.sys in 12 months. CVE-2021-31166, patched last May, was never widely exploited and aside from some PoC exploit leading to denial of service, no actual remote code execution exploit was published. Exploit mitigation techniques in kernel mode drivers make exploitation difficult and may buy us some more time in this case as well. Little detail has been published so far about this vulnerability.

Johannes Ullrich

The combination of disclosure and the RCE flaw in the HTTP stack means attackers are going to be working to discover unpatched systems and exploit them. Don’t make it any easier by neglecting to apply the entire bundle of patches, including the updates for Chromium Edge.

Lee Neely

The term “wormable” gains more visibility for quicker patching. The versions of Windows that have this feature enabled by default varies. More details on the ISC post below.

Jorge Orchilles

The bulletin explains what these threat actors target and how you can mitigate the risks. Don’t limit your scope of mitigations to just these products. Make sure that you’re keeping hardware and software updated, MFA on your entry points is comprehensive, monitoring is working as expected, verify your incident reporting chain. Now execute penetration tests to verify you’re not missing details.

Lee Neely

Critical infrastructure being targeted isn't anything new. But increased tensions with Russia may lead to an increase in activity. Not all that activity may be tightly coordinated but historically, “hacktivist” groups often get involved. Also see the story below about attacks against Ukrainian government websites last night

Johannes Ullrich

This, like activities in Ukraine, are notable because of the current situation Russian state actors are likely to express displeasure online.

Christopher Elgee

It is interesting to note other countries, such as the UK, are also issuing similar alerts. Given today’s interconnected world and our dependencies on supply chains every organization, whether you are located in the US or the UK, should take heed of these alerts and actions on the threat intel within them. https://www.ncsc.gov.uk/news/ncsc-us-partners-promote-understanding-mitigation-russian-state-sponsored-cyber-threats

Brian Honan

For those who are actively involved in CTI or protecting against these specific, there is nothing radically new in these reports. However, joint reports like these are extremely helpful for several reasons. First, because it is a joint report from CISA, NSA and FBI, organizations don’t have to dig around different sites and dig out key information: it’s all provided to them by a combined trusted authority. Second, the report makes it very simple to understand who the threat actor is, the TTPs (mapped to the MITRE ATT&CK model) and what to do. Quite often the problem is cybersecurity is NOT lack of information, but being overwhelmed by information, data points and recommended actions. Reports like these cut through the noise and provide a single, actionable source. That is what I feel is a key role of government guidance, to help make cybersecurity easier for organizations to act on.

Lance Spitzner

This is the biggest news of the week that honestly isn't getting enough attention. If you're running legacy RDP servers, don't miss out on this one. While the CyberArk advisory says the vulnerability extends all the way back to Server 2012R2, Microsoft is pushing patches for Windows 7 and Server 2008R2 through its extended security updates (ESU) channel for those who are subscribers. If you are running RDP on a legacy server and aren't getting patches, make sure you understand the threat. If the threat actor has access to the server, they can retrieve files from any connected client (e.g. the systems admin) and certainly use that to gain code execution on the remote client's machine. The threat actor need not have full control of the RDP server either; they only need an authenticated RDP client. Finally, given the verbosity of CyberArk's writeup, we should expect threat actors to weaponize this vulnerability quickly. These "client to client" and "server to client" exploitation channels are unusual and likely aren't in the threat model of most organizations. Make sure they become part of yours.

Jake Williams

This isn't a "huge" vulnerability, as it requires two users being connected (and authenticated) to the same RDP server. But it is interesting and should be patched quickly as it could easily be used to elevate privileges after obtaining a low privilege account.

Johannes Ullrich

The attack leverages the FIFO behavior of named pipes, allowing an attacker to create a new pipe with the right name which will be used by a new connection before the one created for that connection. This exploit impacts at least Windows Server 2012 R2 forward. Apply the RDP patch from Microsoft. Make sure you’re not directly exposing RDP to the Internet. Monitor RDP servers to make sure that unexpected activity is not occurring. If you’re developing applications which use virtual channels, make sure they are also not subject to a similar compromise.

Lee Neely

Microsoft has been on a months-long bad streak of being in the news for failed patches or needing to push out patches for software vulnerabilities (like the Y2K22 issue) that should have been easily avoided or detected pre-release. It would be good to see Microsoft publish some analysis to see if this is just a random concentration of issues or if something systemic at Microsoft needs to be addressed.

John Pescatore

Make sure you’ve pulled these from the list of patches you’re pushing out. Be prepared to roll back KB5009624, KB5009546 and KB5009557 (Server 2012R2, 2016 and 2019 respectively.) Even big shops like Microsoft can have QA issues, kudos for responding and pulling these back. Note to self, make sure code you tested/created in 2021 isn’t subject to Y2K22 issues, retest now.

Lee Neely

The update from SonicWall was published a month ago; make sure you’ve installed it. Make sure your edge devices are at the top of your security update list. The report from Rapids7 will fuel the fire of attempted exploitation. The flaw is also present in the SMA 200, 210, 400, 410 and 500v products.

Lee Neely

The MDH is following their COOP plan, purchasing, and deploying replacement systems smoothly and according to that plan. Make sure that your plan can be as smoothly executed, be sure to consider the impact of supply chain challenges similar to what we have faced recently.

Lee Neely

Another NewsBites, another reported ransomware attack. This threat is not going away and impacts most organizations. There are many resources to ensure your organization is prepared. Here is a recent relevant article/interview: Repelling A Ransomware Attack: 5 Things You Need To Do To Protect Yourself Or Your Business From A Ransomware Attack: https://medium.com/authority-magazine/repelling-a-ransomware-attack-bryson-bort-of-scythe-on-the-5-things-you-need-to-do-to-protect-b8ff7f990a1b

Jorge Orchilles

BOD 22-01 requires agencies to review the catalog making sure that they don’t have any unmitigated software as well as report the results of the review and mitigation status. The catalog includes mitigation due dates agencies must meet. As this catalog is expected to continuously update, this review and report cycle will need to be operationalized and hopefully properly funded. For those in the private sector, a regular scan of the catalog to see if you’ve got any gaps in your current mitigations would be a good practice.

Lee Neely

With the adoption of cloud services, most organizations are establishing trust relationships with service providers which can exceed, or cannot be limited to, the scope of subscribed services, allowing a direct path to malware stored there. Block access to the indicated domains, verify trust relationships are only in place for approved services, make sure both perimeter and endpoint protections are active and working, monitor for malicious activity.

Lee Neely

The report met the first two objectives very well but is really weak on the lessons learned and recommendations. In general, the report focuses almost completely on response and not at all on detection/prevention in the period between when the compromised Solar Winds software was active but before private industry notifications came out. After 8 years of spending on Continuous Diagnostic and Mitigation solutions, not a single mention of CDM in the report. Some IG audits have started to focus more on threat hunting and active testing. I’d really like to see GAO reports like this focus on proactive detection and prevention actions at least equally to reactive post-compromise response.

John Pescatore

The report is big on response and coordination and highlights what did and didn’t work after the incidents. What is missing is steps agencies can take for improved detection and to mitigate the likelihood of recurrence. Make sure that your logging is sufficient in retention and separation to support forensic activities, that you have comprehensive detection and response systems, and you’ve verified your playbooks are operating properly. Reach out to your peers to keep that relationship current and healthy.

Lee Neely

I would add supplier accountability. The more privileged or powerful a process or user, the more important as a control is accountability.

William Hugh Murray

This is sadly unsurprising and continues to highlight that either NSO is incapable of policing its customers or (more likely) no commercial spyware company can ensure its software isn't abused.

Jake Williams

The report sets the stage and background which lead to use of the spyware in that country and provides context for those actions. While these efforts currently target journalists and the NSO infection vector is a zero-click attack path, we still need to be vigilant, keeping our devices fully updated, keep them under our control, remove unneeded or unused applications, use loaner devices for high-risk situations and use caution with links and attachments.

Lee Neely

These types of defacements are often the work of hacktivists and it is not clear at this point if these attacks abused a specific vulnerability common to these websites.

Johannes Ullrich

While it isn't yet clear whether this is a state-affiliated attack, many have noted that the arrest of REvil ransomware operators may be top cover to get media attention away from these defacements. At this point, there's no clear connection between these events. Kim Zetter reported that these attacks used a known CMS vulnerability, well within the reach of any script kiddie or hacktivist.

Jake Williams

While this isn't new, it is news because of the timing. With cyber attacks on top of land and sea posturing (strikingly reminiscent of 2014!), Ukraine and its allies have plenty of justification for concern.

Christopher Elgee

While it can be argued that with sufficient time and resources any target can be compromised, don’t make it any easier than it has to be. Keep your services patched, make sure that only authorized accounts have access, and you’re using MFA for authentication.

Lee Neely