SEC536: Adversarial AI - Penetration Testing AI Systems
SEC536Offensive Operations, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Tenable Analysis: Many Exchange Servers Remain Unpatched Against ProxyLogon
Tenable researchers' analysis of Salt Typhoon's activity indicates that at least one of the vulnerabilities exploited by the state-sponsored threat actors remains largely unpatched. More than 90 percent of publicly-exposed Microsoft Exchange Servers are not patched against a critical remote code execution vulnerability, known as ProxyLogon, that was disclosed nearly four years ago. Tenable researchers contrast that number with other vulnerabilities exploited by Salt Typhoon: analysis of unpatched instances of 'Ivanti vulnerabilities (CVE-2023-46805 and CVE-2024-21887) ... found that these devices were fully remediated in over 92% of cases.'
Editor's Notes
- Slide 1 of 4
Well that's just embarrassing. The Tenable research doesn't factor in attacker stealthiness, just whether the patch was applied. No way that an organization can claim they practiced a 'standard duty of care' should they suffer a cyber breach.
- Slide 2 of 4
Are Microsoft products difficult to administer?
- Slide 3 of 4
If you're running an old exchange and have ProxyLogon vulnerabilities in your system, it's probably no longer just YOUR system.
- Slide 4 of 4
With all the targeting of Exchange servers, there should be no reason they are not being updated, publicly-accessible or otherwise. If you don't have the resources to keep them updated, it's time to move to hosted services; the cost of a compromise, and recovery, will easily eclipse the cost of moving to a hosted solution.
Slide 1 of 0- Slide 1 of 4
Older Exchange Servers Cannot Receive Emergency Mitigation Definitions
Microsoft is cautioning users that outdated Exchange servers are unable to receive emergency mitigation definitions due to a deprecated Office Configuration Service certificate type. The Exchange Emergency Mitigation Service (EEMS), which was introduced in September 2021 'automatically applies interim mitigations for high-risk (and likely actively exploited) security flaws to secure on-premises Exchange servers against attacks. It detects Exchange Servers vulnerable to known threats and applies interim mitigations until security updates are released.' Exchange server versions older than 2023 are urged to update so they can receive emergency mitigations.
Editor's Notes
- Slide 1 of 3
Simply patching Microsoft products is not adequate. Some must also be replaced on a timely basis, either because they cannot be patched or because patches are no longer being provided.
- Slide 2 of 3
If you're continuing to run your own Exchange servers, update them to newer than the March 2023 Cumulative or Security Update. Next, review when you can move to hosted Exchange servers as it's going to continue to be increasingly challenging to keep your own service sufficiently secure and updated.
- Slide 3 of 3
If you're running an outdated exchange, don't be. If you're running on-premises, keep these things up to date. That's all I have to say.
Slide 1 of 0- Slide 1 of 3
Zyxel Application Signature Update Causes Firewall Boot Loops
A faulty Zyxel application signature update is causing issues for USG FLEX and ATP Series firewalls. Zyxel has disabled the problematic application signature on its servers. According to the Zyxel advisory, the bug 'may cause reboot loops, ZySH daemon failures, or login access problems.' The faulty signature was phased out between January 24 and 25. Fixing the problem requires physical access to the firewall and a Console/RS232 cable.
Editor's Notes
- Slide 1 of 2
Follow the Zyxel instructions to determine if you're affected. Only version "1.0.0.20250123.0" is affected, unless you are using Nebula, USG FLEX X Series, or have no active security licenses on the device. The recovery requires installing a special firmware version, via the console connection. Read the guidance twice, and enlist someone to cross-check you before attempting.
- Slide 2 of 2
This is a nasty bug in the Zyxel equipment (which is very popular in Europe and in ISPs). I'm not sure how many systems this impacted, but the fact that you need to plug into the device physically is concerning.
Slide 1 of 0- Slide 1 of 2
The Rest of the Week's News
Microsoft WSUS Driver Synchronization Deprecation
Microsoft has published a reminder that driver synchronization updates via Windows Server Update Services (WSUS) will be deprecated as of April 18, 2025. Microsoft initially announced the deprecation in June 2024, at which time they encouraged users to adopt newer cloud-based driver services. WSUS was introduced in 2005.
Editor's Notes
- Slide 1 of 2
While many organisations have migrated their core email services to cloud-based solutions, many still run on-premises Exchange servers to support legacy systems or enable ongoing migration of accounts to the cloud. However, it is important to remember that just because you have moved your core email services to the cloud you should not forget your on-premises environments and ensure they remain secure.
- Slide 2 of 2
When this was announced last year, Microsoft said no new features or capabilities would be added to WSUS, and they would continue to publish updates through the WSUS channel as well as support existing content in that channel. It is time to look at Windows Autopatch, Azure Update Manager, and Microsoft Intune for your driver updates. Maybe even revisit your Windows patching implementation to make sure you're following current best practices.
Slide 1 of 0- Slide 1 of 2
Researchers Identify 100+ Vulnerabilities in LTE / 5G Network Implementations
Researchers from the University of Florida and North Carolina State University have identified nearly 120 vulnerabilities in the LTE / 5G core infrastructure. The flaws affect seven LTE implementations and three 5G implementations, both open source and commercial, and could be exploited to cause 'persistent denial of cell service to an entire metropolitan area or city and [in some cases] remotely compromise and access the cellular core.' The researchers contacted affected maintainers and allowed a minimum of 90 days for patch development before disclosing the issues. In all, the 119 discovered vulnerabilities resulted in 97 unique CVEs. Their whitepaper, 'RANsacked: A Domain-Informed Approach for Fuzzing LTE and 5G RAN-Core Interfaces,' describes their methods and process.
Editor's Notes
- Slide 1 of 2
They used two threat models, any unauthenticated device, and an adversary with an authenticated device with base-station access to the cellular core. By unauthenticated device, they mean a device which doesn't need a valid SIM, it only needs to be able to send the right malformed packet sequence. By base-station access, they are mostly referencing home "femtocell" devices (signal boosters) which typically act as a base station "under the hood" which can then be physically manipulated to obtain persistent access. If you have cellular repeaters in your environment, make sure they are not only updated but also running legitimate firmware. Home units are typically updated automatically, but you can check via the management interface from your provider.
- Slide 2 of 2
Our reliance on 5G is increasing rapidly. One hopes that these vulnerabilities are remedied promptly and with minimum disruption to service.
Slide 1 of 0- Slide 1 of 2
Change Healthcare Breach Numbers Updated
UnitedHealth has confirmed that the number of individuals affected by the February 2024 Change Healthcare breach is now estimated to be 190 million. An earlier estimate placed that number at 100 million. When the final number of affected people is determined, that information will be reported to the US Department of Health and Human Services Office for Civil Rights. The attackers were able to access the Change healthcare system using stolen account credentials; the targeted account was not protected with multi-factor authentication (MFA). The compromised data include names, addresses, government identity documents, medical diagnoses, test results, and health insurance information. A January 16 report from UnitedHealth includes information about incurred breach-related costs.
Editor's Notes
- Slide 1 of 3
By comparison there were just over 210 million registered voters in the US for the 2024 elections, total population of the US is estimated at 340 million. This is one of the strongest examples of the need for pervasive use of MFA as well as active account management, to include compromised credential monitoring and response. These need to become table stakes. At this point it is reasonable to assume you are included in the breach. Even if you've not been notified, take action to protect your information.
- Slide 2 of 3
No real surprise here, the number usually goes up as the investigation winds down. It still doesn't change the fact that the company failed to implement and maintain reasonable cybersecurity in protecting customer data.
- Slide 3 of 3
Of course the compromise of PII of subscribers is not the measure of severity of this breach, but rather the healthcare providers who were not paid on a timely basis.
Slide 1 of 0- Slide 1 of 3
British Museum Temporarily Shut Down Some Exhibits Following Tech Sabotage
The British Museum temporarily closed some exhibits and galleries over the weekend after a disgruntled former contractor shut down some of the museum's IT systems. The contractor was dismissed prior to the incident and was arrested after entering the museum on January 23, accessing an area without authorization, and 'caus[ing] damage to the museum's security and IT systems.'
Editor's Notes
- Slide 1 of 4
This one is a timely reminder: there is increasing pressure to bring employees back into the office, which will cause a lot of 'disgruntlement' and increased turnover. Make sure that employee/contractor termination immediately triggers both access revocation and testing to revocation took hold.
- Slide 2 of 4
We have talked about removing logical access for terminated employees, and this also needs to apply to physical access. Both need to be applied immediately in the case of involuntary separation, and in a timely fashion otherwise. While things may need to be on hold for potentially returning staff, that access can still be disabled during that interval rather than left 'as-is.'
- Slide 3 of 4
The question becomes how did the former employee gain access to the restricted area, (access card, keypad on door)? The incident serves as a reminder to IT, HR, and Security teams that all access permissions, physical or electronic should be reset at the time of employee termination and staff properly notified.
- Slide 4 of 4
Ensure that all separations are complete and timely, with special attention to those that are less than friendly. In this age, when contractors are often privileged, such separations must include them.
Slide 1 of 0- Slide 1 of 4
Starlink Vulnerability Exposed Subaru Remote Functions and Data
Sam Curry and Shubham Shah have released a report demonstrating a now-patched vulnerability in Starlink, Subaru's multipurpose onboard services system, that would have allowed an attacker to remotely manipulate any vehicle and exfiltrate data given the owner's last name and "ZIP code, email address, phone number, or license plate." The researchers accessed an employee admin portal through JavaScript flaws in the login process, and bypassed 2FA on the site by simply removing the UI overlay. Any attacker with this access could perform remote operations on the vehicle, starting or stopping the engine, locking or unlocking the doors, and tracking the vehicle's current location and past 12 months of location history, as well as steal extensive customer PII and data about the vehicle's status and history, all without alerting the owner. Subaru patched the flaw within 24 hours of its report.
Editor's Notes
No, not that Starlink, the other STARLINK (sic). Shubham Shah always comes up with something novel, so this is a fun read.
Another Baltic Sea Data Cable Damaged
On January 26, Swedish authorities received word from Latvia that an undersea fiber optic cable belonging to the Latvian State Radio and Television Center (LVRTC), had taken "significant" external damage. Within hours Sweden seized and boarded a cargo ship named the Vezhen, sailing under the flag of Malta, suspected of causing the damage; the Swedish Security Service alongside "the National Operations Department of the Police, the Coast Guard and the Swedish Armed Forces" are investigating, but no further information has been released. The cable in question runs in the Baltic Sea from the town of Ventspils in Latvia to Gotland Island in Sweden, and is the third Baltic Sea cable to be damaged in just over a month. On January 22, Finland's lead investigator into the severing of two undersea cables by an oil tanker on December 25, 2024, stated that the National Bureau of Investigation "suspects intent, but is still evaluating it."
Editor's Notes
- Slide 1 of 4
Physical attacks on undersea cables continue, and Sweden is putting would-be perpetrators on notice that there will be consequences, to include active investigation and detainment of suspected parties. This is also resulting in increased NATO actions in the North Sea. In the meantime, if you're dependent on undersea cables, investigate path diversity options. If you haven't investigated in a couple of years, it's time to revisit.
- Slide 2 of 4
There are approximately three cable cuts a week. There is even a working group trying to establish standards around these. To underscore how impactful this is, it probably takes a month to fix. The backlog may be growing at this point, but it's hard to tell. Considering the sensitivity of this area, it would be interesting to see if any vessels get confiscated. There is a strange thing going on with insurance and the Russian shadow fleet since the Ukraine war. I'm unsure if this is a Russian shadow fleet ship, but this may be something to watch as it can only go on for so long before something more serious occurs.
- Slide 3 of 4
Once can be written off as an accident, twice, bad luck, but three times in the span of a month, umm yes, something untoward is happening to underseas cables. Determining intent will be the tricky part and hard to prove.
- Slide 4 of 4
Cables are fundamentally vulnerable to breakage, both accidental and malicious. Redundancy is important. They should not be allowed to be single points of failure.
Slide 1 of 0- Slide 1 of 4