Monthly Archives: March 2020

Highlights from Pwn2Own 2020

====================
TL;DR:

The following products were successfully exploited, please install the necessary updates for them when they become available: Apple Safari, Apple macOS, Ubuntu Desktop, Windows, Oracle VirtualBox and Adobe Reader
====================
As long-time readers of this blog will know, the Pwn2Own security conference with its white hacking contest is my favourite event of the year. Sophisticated vulnerability exploitation is showcased, the contestants receive large sums of money and we as consumers receive safer products to use on a day to day basis. It took place late last week virtually due to the Coronavirus. The results from both days of competition can be found here. The total prize was USD $270,000.

The winners of the competition were Richard Zhu and Amat Cama of Team Fluoroacetate winning the Master of Pwn title and USD $90,000 in prize money.

Returning to the trend of previous years, exploits against the Apple macOS kernel (defined) and Windows kernel were common again. These are high severity vulnerabilities but when addressed will make our systems safer.

The vendors have up to 90 days to resolve the vulnerabilities before public disclosure. Please expect and apply the necessary security updates to the affected as they become available

Thank you.

Protecting against the Windows Adobe Type Manager (ATM) Zero Day Vulnerabilities

=======================
Update: 15th April 2020
=======================
Microsoft have now issued updates for both of the Adobe Type Manager vulnerabilities. These updates apply to Windows 10, Windows 8.1 and Windows 7 (and their Windows Server equivalents):

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0938

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020

Please install these updates when you can. Thank you.

=====================
TL;DR
A patch for these vulnerabilities is expected at the next scheduled collection of updates to be released on the 14th of April. Until then be aware of attempts to have you open unexpected or suspicious files via clicking links on websites/within emails or opening email attachments. If you are using any version of Windows earlier than Server 2016, 2019 or Windows 10 (Version 1703 or earlier), evaluate if you wish to enable the workarounds until a patch is released. This vulnerability is of critical severity for Windows 8.1 and Windows 7, please be certain your staff are security aware not to open unknown or suspicious attachments/files.

A micro-patch is now available for Windows 7 and Windows 8.1 (including their Windows Server equivalents):

https://blog.0patch.com/2020/03/micropatching-unknown-0days-in-windows.html
=====================

=====================
Update: 30th March 2020
=====================
0Patch have released a micro-patch for these vulnerabilities that is free of charge during these uncertain times (some micro-patches are usually paid for services from 0Patch).

The patch works by blocking Windows from using the common code path used by Windows Explorer, Font Viewer, and applications using Windows-integrated font support to display Adobe Type 1 PostScript fonts. The micro-patch does not protect against local attacks but does block the more important remote attack vector.

The micro-patch is available for Windows versions including Windows 7 and Windows Server 2008 R2 with ESU, Windows 8.1 and Windows Server 2012, both 32-bit and 64-bit:

https://blog.0patch.com/2020/03/micropatching-unknown-0days-in-windows.html

A YouTube video of the micro-patch in action is available from the following link:

https://youtu.be/VmL-C7Tqpac

Thank you.

=====================
Update: 28th March 2020
=====================
As detailed in Microsoft’s security advisory, these zero day (defined) vulnerabilities are of critical severity for Windows 8.1 and Windows 7. Please make certain your staff/users are security aware and strongly advise them not to open unknown or suspicious attachments/files. This is particularly severe when staff/users are likely working from home at this time and the security of systems they are using may not benefit from the firewalls/IPS and proxy servers of their primary work location. Staff/users may even be using their personal laptop/desktops to access corporate data during the current COVID-19 lockdown period.

If possible, please evaluate and implement the appropriate workarounds in Microsoft’s security advisory (which mitigate the vulnerabilities but have the least impact on your day to day work/activities) while the appropriate updates are not yet available.

Thank you.

=====================
Original Post:
=====================
I hope everyone is staying safe under the current circumstances.

Yesterday Microsoft published a security advisory describing the use of vulnerabilities within the Windows Adobe Type Manager (ATM) library by attackers to run unauthorised code on victim systems.

Why should these vulnerabilities be considered important?
If an attacker can persuade you to open a document (a document, you may have been expecting but the email it came in doesn’t look or sound quite right or by clicking a potentially useful link) they may be successful in remotely running code of their choice on your system.

According to Kaspersky a more likely scenario would be “attackers also can exploit this vulnerability through an extension to the HTTP called Web Distributed Authoring and Versioning (WebDAV), which allows users to collaborate on a document. Microsoft suggests disabling the WebClient service, which allows you to use this feature”

https://www.kaspersky.com/blog/windows-adobe-type-manager-vulnerability/34395/

For the attack to be successful you must be using a version of Windows older than Windows Server 2016 (Version 1703 or earlier), 2019 or Windows 10 (Version 1703 or earlier). If your version of Windows is newer as per Microsoft’s analysis : ”The possibility of remote code execution is negligible and elevation of privilege is not possible”.

How can I protect my organisation or myself from these vulnerabilities?
Until an update is made available, be aware and don’t open email attachments that look suspicious or click on links (from emails, while web browsing or via instant message clients) that you weren’t expecting or are suspicious.

If you are using an older version of Windows, consider implementing the workarounds provided by Microsoft in their advisory but please be aware of their potential impact to routine functionality before more widely enabling such workarounds:

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv200006

Thank you and stay safe everyone both inside and outside of cyberspace.

Researchers Reveal Intel LVI Vulnerability

=====================
TL;DR
I’m posting this information to clarify what this vulnerability is and to state it is very unlikely you will need to take any action.

Only applications built with and making use of Intel Software Guard eXtension (SGX) will need to apply updates.

According to BitDefender this vulnerability is difficult to exploit and would likely only be employed by a “determined threat actor, such as a hostile government-sponsored entity or a corporate espionage group would use against a high-profile target to leak mission-critical data from a vulnerable infrastructure”.

Intel have released new mitigations but state “Intel does not believe LVI is a practical method in real world environments where the OS and VMM are trusted”

=====================
How is this vulnerability different than others we have seen published in the past?
Early last week, security revealed the existence of a vulnerability affecting Intel CPUs known as Load Value Injection (LVI)((CPUs, defined). Unlike previous vulnerabilities such as Meltdown, Foreshadow, ZombieLoad etc. instead of data being leaked by exploitation of the vulnerability the researchers chose to inject data into the Intel CPU buffers (small memory areas) and hijack the CPU from carrying out its instructions to capture information while it is transit/being processed. It can also be used to steal data from protected areas of memory known as Software Guard eXtension (SGX) enclaves.

Mitigating the vulnerability is harder and will impact performance more than Meltdown-type attacks.

What Intel CPUs are affected?
Intel provides a full list here:

What Intel SGX updates are available?
Intel SGX Platform Software (PSW) version 2.9.100.2 for Linux, version 2.7.100.2 for Windows and an updated Intel SGX SDK are available, version 2.9.100.2 for Linux and  version 2.7.100.2 for Windows. Download links and further details are available within Intel’s security advisory.

Thank you.

March 2020 Update Summary

====================
Update: 28th March 2020
====================
I have added the details of the security updates released by Apple on the 24th March near the end of this post. Thank you.

====================
Update: 25th March 2020
====================
Adobe has released a further update for Creative Cloud Desktop. I have added the details below to the Adobe updates list.

VMware have also released VMware Fusion 11.5.3 to more completely address a previously patched vulnerability. Details are below in the VMware updates list.

Thank you.

====================
Update: 23rd March 2020
====================

Since originally writing this post, Adobe published their security updates a week later than usual. Further details are listed below.

Thank you.

====================
Adobe
====================
Adobe Acrobat and Reader: 13x Priority 2 CVEs (defined)resolved (9x Critical and 4x Important severity)
Adobe Bridge: 2x Priority 3 CVEs resolved (2x Critical severity)
Adobe ColdFusion:  2x Priority 2 CVEs resolved (2x Critical severity)
Adobe Creative Cloud Desktop: 1x Priority 2 CVE resolved (1x Critical severity)
Adobe Experience Manager: 1x Priority 2 CVE resolved (1x Important severity)
Adobe Genuine Integrity Service: 1x Priority 3 CVE resolved (1x Important severity)
Adobe Photoshop: 21x Priority 3 CVEs resolved (15x Critical and 6x Important severity)

====================
Update: 15th March 2020:
====================
Security researcher Kevin Beaumont has provided further details of the critical SMBv3.1 vulnerability affecting Windows 10 Version 1903 and 1909. In summary the vulnerability is not trivial to exploit and the number of systems at the time of writing (13th March) vulnerability to the exploit had already dropped by 25%.

====================
Update: 12th March 2020:
====================
Microsoft have released an update to resolve the SMBv3 vulnerability now designated CVE-2020-0796, (EternalDarkness or SMBGhost) please apply it to any Windows 10 Server or Windows 10 workstation system running Windows 10 Version 1903 or 1909 as soon as possible. Please also make certain that such systems are not exposing port 445 to the internet (please seethe FAQ in their information on the relevant update).

An internet scan by security researchers of vulnerable estimates that there are 48,000 vulnerable Windows 10 systems. You can use the ollypwn scan (created by a Danish security researcher) can be used to check if a system is vulnerable.

I wish to add the following useful clarification (which was written before the Microsoft security update became available) from Richard Melick, senior technical product manager at Automox in relation to this SMBv3 vulnerability:

“Considering that SMBv3 is not as widely used as SMBv1, the potential immediate impact of this threat is most likely lower than past vulnerabilities. But that does not mean organizations should be disregarding any endpoint hardening that can happen now while Microsoft works on a patch…it’s better to respond today and disable SMBv3 and block TCP port 445. Respond now and vulnerabilities end today”.

To all of my readers, please stay safe during these challenging times. Thank you.

====================
Update: 11th March 2020
====================
As expected, yesterday Microsoft  released their scheduled updates to resolve 115 CVEs (defined). Unusually for this month, Adobe has not released any updates.

Microsoft’s monthly summary; lists Known Issues for 14 Microsoft products but all have workarounds or resolution steps listed just as the previous month’s did.

====================
A further useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

====================
As always for this month’s Microsoft updates, I will prioritize the order of installation below:
====================
For Windows or Windows Server system (Version 1903 and 1909) systems that uses SMBv3, please follow Microsoft’s guidance in the following security advisory while an update is not yet available. Please apply the update as soon as it is made available:

ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression

Please also make certain that TCP port 445 is blocked at the enterprise perimeter firewall to prevent exploitation.

This vulnerability is “wormable” meaning that similar to the WannaCry malware and the BlueKeep vulnerability if exploited it may lead to a very large malware outbreak in a very short time.

====================

Windows LNK: CVE-2020-0684
Windows Media Foundation: CVE-2020-0801 , CVE-2020-0807 , CVE-2020-0809,  CVE-2020-0869
Microsoft Internet Explorer: CVE-2020-0824
Microsoft Browsers: CVE-2020-0768

Microsoft Scripting Engine: CVE-2020-0830 , CVE-2020-0847, CVE-2020-0833 , CVE-2020-0832, CVE-2020-0829 , CVE-2020-0813 , CVE-2020-0826, CVE-2020-0827 , CVE-2020-0825 , CVE-2020-0831, CVE-2020-0811, CVE-2020-0828, CVE-2020-0848, CVE-2020-0823, CVE-2020-0812

Microsoft GDI+: CVE-2020-0881, CVE-2020-0883
Microsoft Word: CVE-2020-0852
Microsoft Dynamics: CVE-2020-0905
Microsoft Edge: CVE-2020-0816

====================

Please install the remaining updates at your earliest convenience.

As per standard best practice; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

I have also provided further details of updates available for other commonly used applications and devices below.

To all of my readers, please stay safe during these challenging times. Thank you.

====================
Netgear
====================
On the 3rd of March, Netgear released 25 security advisories for its modem-router gateways, approximately 40 routers and a range extender. The vulnerability range up to critical in severity.

If you own a Netgear router, range extender or modem-router gateway, please use the guidance within this article (many thanks to Tom’s Guide for this advice and the appropriate how to check for updates steps) to locate your Netgear device model e.g. R6400 and to match it against the available security bulletins to check if your device requires a firmware (defined) update sometimes called a software update. Please install the update if one is available. The above linked to article also describes the varied methods to update your Netgear device.

====================
Intel Security Advisories
====================
Intel have released a series of security advisories this month. The advisories are prioritised below. If you use any of these products, software or devices, please update them as soon as possible especially in the case of the high severity advisories.

High
Intel Smart Sound Technology Advisory
BlueZ Advisory
Intel NUC Firmware Advisory

Medium
Intel MAX 10 FPGA Advisory
Intel Processors Load Value Injection Advisory
Snoop Assisted L1D Sampling Advisory
Intel Optane DC Persistent Memory Module Management Software Advisory
Intel FPGA Programmable Acceleration Card N3000 Advisory
Intel Graphics Drivers Advisory

====================
Mozilla Firefox
====================
Yesterday, Mozilla released Firefox 74 and Firefox ESR (Extended Support Release) 68.6 to resolve the following vulnerabilities:

Firefox 74.0: Addresses 6x high severity CVEs, 6x medium severity CVEs and 1x low CVE

Firefox 68.6 ESR: Addresses 5x high severity CVEs and 3x medium severity CVEs

Firefox 74 also removes support TLS 1.0 (what is TLS, defined) and 1.1 as per Mozilla’s previous timelime, adds a Facebook Container add-in to limit how much the social tracks you across other sites and blocks the ability for other applications to install Firefox add-ons without your knowledge or consent. Further details of these features and other features added can be found within this article (my thanks to Lawrence Abrams of Bleepingcomputer.com for this information).

====================
Google Chrome
====================
Early last week, Google released Chrome version 80.0.3987.132 for Linux, Mac and Windows to resolve 4 security vulnerabilities with the most severe being of high severity.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.

=======================
Apple Security Updates:
=======================
On the 24th of March Apple made available the following updates. Notable fixes affect the kernels of macOS, iOS and iPadOS, WebKit (the renderer of Safari), Bluetooth and Safari.

These updates bring Safari to version 13.1 and add updates to its Intelligence Tracking Prevention (ITP) privacy feature while also introducing a block on all 3rd party cookies (defined) by default.

Further details for these updates are as follows:
Apple iOS v13.4 and iPadOS 13.4 (resolves 35x CVEs (defined))
Apple tvOS 13.4: Resolves 20x CVEs.
Apple watchOS 6.2: Resolves 17x CVEs
Apple watchOS 5.3.6 (no CVEs resolved)
Apple iTunes version 12.10.5 for Windows: Resolves 13x CVEs
macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra: Resolves 27x CVEs.
Safari 13.1: Resolves 11 CVEs
Apple iCloud for Windows 10.9.3: Resolves 13 CVEs
Apple iCloud for Windows 7.18: Resolves 13 CVEs
Xcode 11.4: Resolves 1 CVE (?: Apple’s post provides little details)

=======================

Please see these links from Apple for advice on backing up your iPhone and iPad. Advice for updating tvOS is available here while the steps for updating the Apple Watch are available here.

As always; further details of these updates are available on Apple’s dedicated security updates page.

For advice on how to install updates for Apple devices, please see the steps detailed at the end of this Sophos blog post as well as this link (from my “Protecting Your PC” page).

====================
OpenSSL
====================
On the 17th March the OpenSSL Foundation issued OpenSSL 1.1.1e (download/installation links included) which includes a low severity security fix.

FTP mirrors to obtain the necessary downloads are available from here.

Downloadable Tarballs (compressed/packaged code made for distribution) are available from here.

It should also be possible to use the package manager of a Linux/Unix operating system to update your OpenSSL installation as mentioned within the section titled “Installing updates for Linux distributions” on the “Protecting Your PC” page of this blog.

====================
VMware
====================
VMware have so far released 2 security advisories this month to resolve vulnerabilities within the following products:

====================
Advisory 1: Severity: Critical:
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)
VMware Horizon Client for Windows
VMware Remote Console for Windows (VMRC for Windows)
====================
Advisory 2: Severity: Important:
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)
VMware Remote Console for Mac (VMRC for Mac)
VMware Horizon Client for Mac
VMware Horizon Client for Windows
====================

Advisory 2 (above) has been updated by VMware to state VMware Fusion has been updated to version 11.5.3 to more comprehensively resolve the vulnerability designated CVE-2020-3950. Please make certain if you use VMwre Fusion that it is the latest version available.

If you use any of the above products, please review the above advisories and install the applicable security updates as soon as possible.

Blog Post Shout-Out March 2020

With ransomware attacks continuing to be prevalent if you have an unaffected backup you won’t need to pay the ransom. However, how you backup your data (how many copies do you create?), the software you use and how it is configured can all make a difference.

Recommendation for how to create your corporate backups and how to better secure it are provide in the following article (which also includes details gathered from ransomware operators).

Ransomware Attackers Use Your Cloud Backups Against You by Lawrence Abrams (Bleeping Computer)

In previous posts I have provided recommendations for better securing Internet of Things (IoT) devices, to re-emphasise the basic steps, I also wish to provide a respectful shout-out to the following article highlighting the publication of guidance from the UK National Cyber Security Centre (NCSC):

UK NCSC Releases Tips on Securing Smart Security Cameras by Sergiu Gatlan (Bleeping Computer)

Full-disclosure: I am not affiliated or sponsored by Bleeping Computer in any way. I simply wish to more widely highlight good advice on topical security issues.

Thank you.