Daily Archives: May 1, 2017

DoublePulsar exploit: victim devices are widespread

Last month the hacking group known as the Shadow Brokers made available a set of exploits (this appears to be their last remaining set). These exploits allegedly came from the NSA. A full list of the exploits is available here. Microsoft’s analysis of the exploits made which applies to their products and which security updates resolve them are available here.

What is DoublePulsar and how does it affect a system?
The exploit from this recently released collection which targets the Windows SMB Server component of Windows is known as DoublePulsar. It is a kernel mode (or ring zero (defined)) exploit which provides an attacker with full control over an affected system as well as providing a backdoor (defined).

It is also allows the execution of shellcode (defined) and the downloading of further malware. A complete list of it’s capabilities is available from Symantec’s analysis.

This threat is being called similar to the MS08-067 vulnerability from October 2008 which lead to widespread installation of the Conficker malware (which still persists today). That article estimates this vulnerability will be with us for many years to come. In my professional career I still see large numbers of servers and workstations not patched against the MS08-067 vulnerability even after all these years. The exploits made available by the Shadow Brokers have been made easy to use by others posting YouTube videos and documentation of how to use them. Security researchers are tracking the spread of this malware here , here and here.

How can I protect myself from this threat?
Preventing a compromise by this threat:

If your servers or workstations have Windows Server 2008 or Windows Vista (respectively) or newer installed, please install Microsoft’s security update MS17-010 as soon as possible. As a defense in-depth measure (defined)(PDF), please also consider blocking port 445 from being accessed externally (since this is unlikely to be the last SMB exploit we see).

Please note, Windows Vista systems are also no longer supported and you should consider upgrading (if you are not already in the process of doing so). Windows Server 2008 will be supported until the 13th of January 2020.

Update: 19th May 2017:
With the rapid propagation of the WannaCry ransomware, Microsoft made available the MS17-010 update for Windows XP, Windows Server 2003 and Windows 8.0. The updates for these out of support operating systems are available from Microsoft’s blog post.

Once the update is installed, if your servers or workstations have Window Server 2003 or Windows XP (respectively) installed, please block port 445 (the Windows SMB protocol port) from being accessed from an external network (as previously recommended by US-CERT and mentioned in a past blog post of mine).

In addition to blocking port 445 as mentioned above, I would also suggest the following:

If you can, segregate your vulnerable devices (including devices within your network perimeter) so they don’t expose the following ports:

  • TCP port 445 with related protocols on UDP ports 137-138
  • TCP port 139
  • Also disable SMBv1 (it’s a deprecated protocol)
  • Please also block the Remote Desktop Protocol (RDP) port 3389 (defined) at the entry point to your corporate to prevent the spread of this malware as recommended by the US CERT.

To check if your system has been compromised by Double Pulsar, you can use this tool.

Removing the threat from a compromised system:
You can remove the infection simply by shutting the system down since the malware does not persist after a reboot. You can then patch the vulnerability and block access to port 445 to prevent the malware from returning (both as mentioned above).

Thank you.

Internet of Things malware destroys devices

In early April embedded devices powered by Google Android, Linux and FreeBSD (specifically the BusyBox distribution) mainly used as media players and routers came under attack from a previously unseen form of malware.

How does this malware affect compromised devices?
Once compromised the device will cease functioning within seconds; an attack being called a PDoS (Permanent Denial of Service). This occurs since the malware corrupts the devices internal storage and reduces the number of kernel (defined) threads (sequences of independent in progress tasks) from several thousand to just one, causing the devices in progress tasks/work load to halt. Security firm Radware demonstrated this result with a webcam.

How does this malware initially compromise a device?
Since early April four unique versions of this malware (dubbed BrickerBot) have emerged. The first version attempted to compromise Radware’s test device almost 2,000 times within four days with the attacks originating from all over the world. The second and more advanced version uses Tor (The Onion Router) to enable attacks to take place from the Dark web (a portion of the internet only accessible using the Tor network). This makes tracing the source of the attacks almost impossible.

Versions 3 targets further devices while version 4 was active during a very briefly and ceased its activity after 90 attempted attacks. Radware provide more details in their analysis.

The malwares authors seek to gain control of vulnerable devices by attempting to access them over the internet via the Telnet protocol (defined, which uses TCP and UDP ports 23) by entering commonly used usernames and passwords until successful. If your network contains routers or music/media devices using the BusyBox distribution they are potentially vulnerable to this malware. Attackers can use tools such as Shodan (defined) to locate vulnerable devices over the internet and begin an attack.

How can I protect my devices from this malware?
Radware provide five steps you can take to better secure your internet of things (IoT , defined) devices from this malware. They also suggest the use of an IPS (defined) in this related blog post. The above recommendations are especially important since unlike other malware where you can re-format a hard disk and re-install the operating system (defined), this malware permanently damages the device and it will require a replacement.

Thank you.

Punycode makes phishing harder to detect

In mid-April, security researcher Xudong Zheng publicly disclosed (defined) and provided a demonstration of a security vulnerability within popular web browsers e.g. Google Chrome, Mozilla Firefox and Opera which may be used in phishing (defined) attacks.

Why should this vulnerability be considered important?
This vulnerability is not the first of kind, e.g. a similar vulnerability exists in how the DNS protocol resolves device hostnames (defined) (when combined with Service Discovery (SD) provides the capability of network resource distribution beyond the reach of multicast normally limited by the MAC Bridge.
However this vulnerability has the potential to allow an attacker to lead you into clicking a legitimate looking link which may lead to an unexpected website (which an attacker can populate with content of their choice). This may happen since an attacker can send you a highly targeted email (i.e. spear phishing) which you may be expecting and inadvertently click an undesired link or enter login details into a legitimate looking website (following a link from such an email).

Mr. Zheng demonstrates how this vulnerability exploits how web browsers translate letters from other non-Latin languages into Latin letters. For example, he registered the website of apple.com which when visited actually displays the website of xn--80ak6aa92e.com but your web browser will still show apple.com This occurs due to the translation of non-Latin letters into Latin characters making use of Punycode (a recognized standard of the Internet Engineering Task Force).

How can I protect myself from this vulnerability?
While the conventional advice of hovering over any link before clicking to view its actual destination is not redundant it is now significantly less useful.

If you use a password manager which works with your web browser it will not enter your username/password into a website translated from its Punycode. For example, your Apple credentials would not be entered into xn--80ak6aa92e.com

Google has addressed this vulnerability with the release of Chrome version 58. Opera also resolved this issue. Mozilla is currently considering the best means to resolve this vulnerability (Firefox 53 mistakenly shows apple.com) . In the meantime; Mozilla Firefox users can use the steps mentioned at the end of this news article to mitigate this issue.

For any website important to you, please manually type its address into your web browsers address bar to visit the legitimate website. Using encrypted connections where possible is encouraged e.g. https://twitter.com or https://mail.google.com

Thank you.