Do you ever wonder if your smart home is vulnerable to cyber threats? As we place more and more connected devices in our homes to automate simple tasks that used to be done manually, we also place more and more risk for unwanted attackers to compromise our personal lives.

What if you had a way to find out whether there are vulnerabilities in your home systems that attackers can exploit?

You’re in luck! You can use a vulnerability scanner like Nessus Essentials to do the job. In this post, we will step through the quick, four-step process.

Before getting started: Although unlikely, scanning may cause device disruption. Typically, rebooting the device will bring it back online.

#1. Set up your scanner

Register and download Nessus Essentials. 

Once you register, you will receive an email with the activation code. Next, download the appropriate Nessus file for your operating system.

Install Nessus Essentials by opening the file and proceeding through the wizard. Once complete, a browser should open up that takes you to the Nessus Scanner website on your local machine. If the website does not appear, open a browser and head to https://localhost:8834.

Nessus will begin to compile its plugin database, so you can scan for vulnerabilities.

Plugins are scripts that check for vulnerabilities on your smart home devices. For example, there is a Windows plugin that checks for all installed software on your computer. 

You can search for more plugins here. 

Once the Nessus Essentials user interface loads, you will be prompted to create a username and password. You’ll also need to enter the activation code previously sent to your email.

#2. Set up a scan

Afterward, you will see the following screen where you can enter your target IP.

Place the local IP address of your smart home device in the Targets box and then click “Submit.” Don’t know the local IP address of your smart home device? Log in to your home router and look at the connected devices section. This section will list all items connected to your router and their local IP address.

#3. Run your first scan – and review the results

Nessus will then attempt to find the device’s name. Select the device in the box below and click “Run Scan.”

Once the scan completes, review the results of the plugins.

By looking at my OS identification Plugin, we can see that this is my Smart TV.

Upon reviewing the overall results, you can see that my Smart TV has some SSL issues as well as HTTP and TLS issues. We can take a closer look by clicking the issues.

By clicking once more on a particular plugin, you can find further information.

#4. Decide whether you need to take action

By looking at the Description, Solution, See Also and Output sections, you can determine if this vulnerability is a threat to the device, if exploited. Once you have a good understanding of the vulnerability, take action with the recommended solution and/or contact the device vendor about the vulnerability to request an appropriate fix.

Note: It may not always be possible or necessary to remediate the vulnerabilities found with your vulnerability scanner. Also, the device vendor may release an update before the vulnerability is remediated.

Business system risk and process integrity risk are two essential metrics for a mature risk-based vulnerability management practice. With new assessment maturity scoring, Tenable Lumin now gives you insights into both.

Risk-based vulnerability management requires metrics addressing two types of risks:

• Business system risk
• Process integrity risk

Reducing business system risk requires understanding which assets are most critical to your organization and which vulnerabilities on those assets pose the greatest likelihood of being exploited. Business system risk measurements have been the foundation of Tenable Lumin to date.

Meanwhile, process integrity risk is the exposure your organization faces due to inadequate vulnerability management procedures. Understanding your process integrity risk can help you answer questions like:

• What critical processes (e.g., scanning frequency and depth) need to be improved?
• What new processes/directives should we undertake?
• How do our processes compare with others in my industry?
• Am I optimizing my assessment efforts by business unit, geography and asset groups?

Reducing process integrity risk involves understanding remediation effectiveness and assessment maturity, a single metric that quantifies and compares how well your organization is assessing your environment for vulnerabilities.

Unfortunately, many organizations do not take a mature approach to process integrity. In their Cyber Defender Strategies report, Tenable Research found that 52% of organizations have a low to medium level of maturity when it comes to their vulnerability assessment. Only 5% follow a diligent style with high assessment frequency, comprehensive asset coverage and targeted, customized assessments.

Source: Cyber Defender Strategies: What Your Vulnerability Assessment Practices Reveal

If your vulnerability assessment processes are lacking in frequency and completeness, you might be avoiding a serious breach through sheer luck. Taking a more diligent approach is the smarter choice.

Assessment maturity: A gauge of vulnerability management process integrity risk

Assessment maturity scoring, now incorporated into Tenable Lumin, provides metrics for assessing process integrity risk – and thus implementing policy and process improvements. It helps answer the why behind your cyber exposure status with insights and recommended actions to reduce your exposure. Specifically, it provides information on the degree to which you should increase scan frequency, plugin coverage and authentication. It also identifies pockets of differences within your organization and against industry peers.

Assessment maturity metrics

Assessment maturity is a new metric found in Tenable Lumin that quantifies how well your organization is scanning your environment. It provides this insight by computing two underlying components:

1. Scan frequency: How frequently do you scan each asset in your network? This metric is calculated based on the number of unique days an asset was scanned during a given time window.
2. Scan depth: How deeply or thoroughly do you scan each asset for vulnerabilities? This metric is a function of the number of plugins included in a scan and whether or not the asset was successfully authenticated.

The assessment maturity score combines scan frequency and scan depth into a single number. The assessment maturity score for a group of assets is the average of the assessment maturity scores for the individual assets.

Assessment maturity grade

Tenable Lumin assigns your organization a grade for your scan frequency, scan depth and overall assessment maturity scores, along with comparisons to industry peers and the overall population. Using this grading, you can compare your efforts to others and improve your processes accordingly.

Recommended actions

Tenable Lumin provides explicit recommendations on how you can reduce your process integrity risk such as including policy templates and scheduling the frequency and depth of scans.

Remediation effectiveness (how old is the unremediated vulnerability?)

To reduce process integrity risk, you also need to look at remediation effectiveness. One key metric providing insight into the effectiveness of remediation processes is the age of the unremediated vulnerabilities resident in your organization. Tenable Lumin provides insight into the length of time vulnerabilities have existed on your systems with information on the criticality of assets and priority rating of the vulnerabilities.

Reducing your Cyber Exposure Score – recommended actions

To reduce your risk in the most effective manner, Tenable Lumin also provides a prioritized list of the set of recommended actions that will have the most impact on reducing your Cyber Exposure Score.

Use Tenable Lumin to manage cyber risk

If you’d like to evaluate your organization’s business system and process integrity risk, start your free trial of Tenable Lumin now.

Researchers find several flaws in a proprietary protocol used by many Cisco devices.

Background

On February 5, researchers at Armis Security announced their discovery of five vulnerabilities in the Cisco Discovery Protocol, a proprietary protocol designed to allow for discovery and communication between Cisco devices.

Analysis

CDPwn is a series of vulnerabilities in Cisco Discovery Protocol due to improper validation of Cisco Discovery Protocol messages. By sending a specially crafted packet to a vulnerable device, an unauthenticated, adjacent attacker could achieve remote code execution or create a denial of service condition.

Cisco notes in their advisories that because Cisco Discovery Protocol is a Layer 2 protocol, an attacker “must be in the same broadcast domain as the affected device.”

The following are the five vulnerabilities disclosed by Armis:

According to Armis, these vulnerabilities “affect tens of million devices” including Cisco NX-OS switches, Cisco IOS XR routers, Cisco NCS Systems, Cisco 8000 IP Cameras, Cisco Firepower Firewalls, and Cisco IP Phone 7800 and 8800 Series.

Exploitation requires the Cisco Discovery Protocol to be enabled and Cisco notes that it is enabled by default on certain devices using NX-OS and FXOS, though it is not enabled by default on routers using Cisco IOS XR.

Proof of concept

At the time this blog was published, there was no proof-of-concept code for any of the CDPwn vulnerabilities disclosed by Armis.

Solution

Cisco has released software updates to address these vulnerabilities. They’ve identified a list of vulnerable and not vulnerable products. The list below contains links to the respective section of each advisory that identifies vulnerable products.

• CVE-2020-3110
• CVE-2020-3111
• CVE-2020-3118
• CVE-2020-3119
• CVE-2020-3120

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Dedicated Page for CDPwn from Armis Security

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Microsoft smashes the CVE count with security patches for 99 CVEs, 12 of which are rated as critical.

Microsoft addresses a staggering 99 CVEs in the February 2020 Patch Tuesday release. This update contains 17 remote code execution flaws and 12 vulnerabilities rated as critical. This month’s updates include patches for Microsoft Windows, Microsoft Office, Microsoft Edge, Internet Explorer, Microsoft Exchange Server, Microsoft SQL Server, Microsoft Office Service and Web Apps, Windows Malicious Software Removal Tool and Windows Surface Hub. The following is a breakdown of the most important CVEs from this month’s release.

CVE-2020-0673 and CVE-2020-0674 | Scripting Engine Memory Corruption Vulnerability

CVE-2020-0673 and CVE-2020-0674 are both remote code execution vulnerabilities due to the way in which the scripting engine handles objects in memory in Internet Explorer. Exploitation of these vulnerabilities could allow an attacker to corrupt memory and execute arbitrary code with the same level of privileges as the current user. CVE-2020-0674 was first noted as being exploited in the wild in January, where Microsoft released an out-of-band advisory (ADV200001). The advisory provided mitigation steps at that time. However, this month, Microsoft provided an update to correct these vulnerabilities, which modifies how the scripting engine handles objects in memory.

According to Google Project Zero researcher Maddie Stone, CVE-2020-0674 is the “3rd attempt” to patch this vulnerability after it had been patched two times before. The previous CVEs associated with this vulnerability are CVE-2019-1367 and CVE-2019-1429. CVE-2019-1367 was originally patched out-of-band in September 2019 after exploitation had been observed in the wild, while CVE-2019-1429 was patched in Microsoft’s November 2019 Patch Tuesday and also observed to be exploited in the wild.

CVE-2020-0674 is patched today after in-the-wild exploitation detected by @_clem1 of Google TAG. This is now the 3rd attempt to patch this bug after 2 misfixes (CVE-2019-1367/CVE-2019-1429). We have to fix these bugs the 1st time, especially when they've been exploited itw.

— Maddie Stone (@maddiestone) February 11, 2020

CVE-2020-0662 | Windows Remote Code Execution Vulnerability

CVE-2020-0662 is a remote code execution vulnerability wherein an attacker with a domain account could manipulate Windows’ memory handling to execute injected code. The attacker could leverage the domain account to execute this attack from within the target network, without needing to directly log in to the affected device.

CVE-2020-0681 and CVE-2020-0734 | Remote Desktop Client Remote Code Execution Vulnerability

CVE-2020-0681 and CVE-2020-0734 are both remote code execution vulnerabilities within the Windows Remote Desktop Client. An attacker can exploit these flaws to execute arbitrary code on the connecting client. This requires the attacker to convince a user to connect to a malicious server or have control over a server that a user could be persuaded to connect to. While these CVEs are not reportedly exploited in the wild, Microsoft does rate these as Critical and label them as ‘Exploitation More Likely.’

CVE-2020-0655 | Remote Desktop Services Remote Code Execution Vulnerability

CVE-2020-0655 is a remote code execution vulnerability in Remote Desktop Services that allows an authenticated attacker to abuse clipboard redirection. If an attacker manages to successfully exploit this vulnerability, it could result in the execution of arbitrary code on the target system, allowing not only the viewing, alteration and deletion of data, but also the ability to install applications and create new users with admin-level privileges. For an attacker to exploit this vulnerability, they must already have compromised the target system running Remote Desktop Services and wait for a victim to connect to the service.

CVE-2020-0660 | Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability

CVE-2020-0660 is a denial of service (DoS) vulnerability in Windows RDP in which an attacker could connect to a target system using RDP while sending malicious requests in such a way that the protocol ceases to function. This could be used to stop administrators from connecting to critical infrastructure during an attack or isolate targets after infection.

CVE-2020-0688 | Microsoft Exchange Memory Corruption Vulnerability

CVE-2020-0688 is a remote code execution vulnerability in Microsoft Exchange that would allow an attacker to send a malicious email to a vulnerable Exchange server and run commands as the system user. An attacker could add, delete or modify any settings in Exchange, allowing them to monitor email communications within an organization and likely gain access to sensitive information.

CVE-2020-0683 and CVE-2020-0686 | Windows Installer Elevation of Privilege Vulnerabilities

CVE-2020-0683 and CVE-2020-0686 are elevation of privilege vulnerabilities that exist in the Windows Installer when MSI packages process symbolic links. An attacker who successfully exploits this vulnerability could bypass access restrictions and add or remove files. To exploit this vulnerability, the attacker first needs to be able to log on to the target system and then execute a specially crafted application.

CVE-2020-0706 | Microsoft Browser Information Disclosure Vulnerability

CVE-2020-0706 is an information disclosure vulnerability in Microsoft browsers that affects how cross-origin requests are handled. An attacker who successfully exploits this vulnerability could ascertain the origin of all webpages visited in the vulnerable browser. For an attacker to exploit this vulnerability, they would have to insert specially crafted content on either a malicious website or a compromised website, and convince a victim to visit the malicious site and view the content.

CVE-2020-0738 | Windows Media Foundation Memory Corruption Vulnerability

CVE-2020-0738 is a memory corruption vulnerability in Windows Media Foundation. An attacker would need to trick a user into visiting a malicious webpage or open a malicious file. Once compromised, the attacker could completely modify local Windows user settings and therefore become an administrator on the target machine.

CVE-2020-0689 | Microsoft Secure Boot Security Feature Bypass Vulnerability

CVE-2020-0689 is a security feature bypass vulnerability in Microsoft’s implementation of Secure Boot. An attacker could exploit the flaw by running a specially crafted application, which would result in the bypass of secure boot, allowing the attacker to load untrusted software. Prior to applying the standalone security updates for this vulnerability, Microsoft advised the following prerequisite Servicing Stack Updates be installed.

CVE-2020-0757 | Windows SSH Elevation of Privilege Vulnerability

CVE-2020-0757 is an elevation of privilege vulnerability due to a flaw in how Windows handles Secure Socket Shell (SSH) remote commands. To exploit this flaw, an attacker would need to first log onto a system and execute a crafted application. This would allow an attacker to execute privileged commands with a lower-level user account.

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name Contains February 2020.

With that filter set, click the plugin families to the left, and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s February 2020 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

• Microsoft's February 2020 Security Updates
• Tenable plugins for Microsoft February 2020 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Severe vulnerability in ThemeGrill Demo Importer WordPress plugin is being actively exploited in the wild. Users should upgrade to version 1.6.3 ASAP.

Background

The ThemeGrill Demo Importer WordPress plugin allows users to import ThemeGrill theme demos in one click. Versions 1.3.4 to 1.6.2 are vulnerable to a remote unauthenticated database wipe and authorization bypass vulnerability. Users are encouraged to upgrade to version 1.6.3 as active attacks have been reported in the wild against users on 1.6.2 and below.

Analysis

On February 15, WebARX disclosed a vulnerability in the ThemeGrill Demo Importer for WordPress, which could allow an unauthenticated, remote attacker to execute administrator functions, including reverting all the site’s settings back to their default configuration and wiping all the database tables.

To exploit this vulnerability, a ThemeGrill theme must be installed and activated on a site. If there is an administrative user with the username ‘admin,’ then an attacker will also be automatically logged in as ‘admin’ after the site is wiped.

Proof of concept

There is no public proof of concept (PoC) available at this time, but attacks have been reported by WebARX, and a list of known malicious IPs can be found at the bottom of the WebARX disclosure page.

Vendor response

On February 16, ThemeGrill released 1.6.2 to address this vulnerability. However, ThemeGrill released version 1.6.3 on February 18 to address issues with the initial fix. Version 1.6.3 removes the automatic invocation of a full reset, and instead directs the user to the plugin’s reset wizard. This comes after reports that users on version 1.6.2 were still being exploited.

Solution

At the time of publication, there is no known effective workaround that would not disrupt functionality of the plugin. Users are encouraged to upgrade to version 1.6.3 of the plugin for mitigation.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• ThemeGrill Demo Importer WordPress Plugin Page
• WebARX Disclosure Page
• ThemeGrill Demo Importer 1.6.3 Source Changes

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Availability of proof-of-concept (PoC) code for recently disclosed remote code execution flaw in Microsoft SQL Server Reporting Services leaves sites vulnerable to attack.

Background

On February 11, Microsoft patched a remote code execution vulnerability in Microsoft SQL Server Reporting Services (SSRS), which provides “a set of on-premises tools and services that create, deploy, and manage mobile and paginated reports.” The issue was reported to Microsoft by Soroush Dalili, principal security consultant at MDSec.

Analysis

CVE-2020-0618 is an improper input validation vulnerability in the ReportingServicesWebServer.dll of SSRS. According to a blog post from Dalili, the OnLoad method of the Microsoft.Reporting.WebForms.BrowserNavigationCorrector class passes untrusted user input (e.g. a serialized payload passed via the NavigationCorrector$ViewState parameter) to the LosFormatter class to be deserialized.

In his research, Dalili observed the Microsoft.Reporting.WebForms.BrowserNavigationCorrector class was used by the Microsoft.ReportingServices.WebServer.ReportViewerPage class.

To exploit the flaw, Dalili targeted the ReportViewer.aspx file on a SharePoint server. By sending a specially crafted POST request containing a serialized payload generated using ysoserial.net, Dalili could trigger the exploit, obtaining a shell on the vulnerable server.

Microsoft SSRS needs to be installed before an attacker can exploit the flaw. However, we’re seeing reports from security researchers who are searching for vulnerable instances.

Found and reported CVE-2020-0618 on a server of a very large car company :P Lets see if its a dupe :P

— Damian Schwyrz (@damian_89_) February 18, 2020

Penetration tester Damian Schwyrz recently identified and reported the flaw “on a server of a very large car company.”

Additionally, Dalili shared a Google search query that shows over 8,900 publicly accessible instances of ReportViewer.aspx, many of which appear to be government-related.

so many gov websites listed just in google...

— Soroush Dalili (@irsdl) February 18, 2020

It is unclear how many of the sites found in this Google search are actually vulnerable to the flaw. However, the uncertainty won’t prohibit attackers from attempting to identify vulnerable sites and exploit the flaw in the wild.

Proof of concept

As mentioned above, Dalili published a PoC for the vulnerability in a blog post on February 14. A GitHub repository featuring Dalili’s PoC was published the same day. At the time this blog post was published, there were no full-fledged exploit scripts available for this vulnerability.

Solution

Microsoft patched this flaw on February 11 as part of Patch Tuesday. According to their advisory, the vulnerability affects Microsoft SQL Server 2012, 2014 and 2016. However, additional reporting from security researcher Kevin Beaumont confirmed this flaw also affects Microsoft SQL Server 2008. The reason 2008 is not listed in the advisory is because it reached its end-of-support cycle in July 2014.

Tested it. MS don’t test again unsupported software.

— Kevin Beaumont (@GossiTheDog) February 18, 2020

Microsoft has provided General Distribution Release (GDR) and a Cumulative Update (CU) for the affected SQL Server versions. According to Microsoft, GDR updates “only contain security updates for the given baseline” while CUs “contain all functional fixes and security updates for the given baseline.”

Please refer to the table below for the applicable update of your SQL Server based on your current version.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability can be found here. This includes an uncredentialed check (plugin ID 133718), which requires enabling paranoid mode.

Get more information

• Microsoft Advisory for CVE-2020-0618
• Blog Post Analyzing CVE-2020-0618 by Soroush Dalili
• Tweet from Kevin Beaumont confirming SQL Server 2008 Affected

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

“Thank you Elon,” “God Bless You Elon” and “God Bless You Donald” – scammers have been lurking in the Twitter replies of the U.S. President, Tesla CEO and other notable figures, impersonating followers and using photoshopped tweets to promote fake cryptocurrency giveaways.

Since the beginning of 2020, scammers have been capitalizing on the high engagement on tweets from some of the most followed Twitter accounts in a scheme to trick followers to participate in cryptocurrency giveaways.

The crypto scam level on Twitter is reaching new levels. This is not cool.

— Elon Musk (@elonmusk) February 1, 2020

Old scam, new twist

Since 2018, a variety of cryptocurrency scams have circulated on Twitter impersonating cryptocurrency figures as well as Elon Musk and President Trump, two of the most popular personalities in these impersonations.

Image source: BuzzFeedNews

Impersonation of President Trump’s Twitter followers

The latest tactic used by cryptocurrency scammers is to impersonate vocal Twitter users who regularly respond to tweets from President Trump.

One of the earliest instances of this tactic was seen on January 2. Scammers used an impersonation account of Ryan Hill, a vocal Twitter user who regularly responds to President Trump. The scammers responded to one of Hill’s tweets to Trump. Their tweet included the quote, “And also, thanks to Elon for this,” and a photoshopped image of a fake tweet from Elon Musk. The photoshopped tweet from Musk claimed Tesla decided to “throw a crypto party,” where they would be giving away Bitcoin and Ethereum, two of the most popular cryptocurrencies. It included a link to a website with details about the supposed “crypto party.” The photoshopped tweet also contains fake replies from users claiming the supposed giveaway is legit.

Variety of impersonations

A variety of impersonations of vocal Twitter users appear in President Trump’s tweets. And most of these impersonators respond directly to the person they’re impersonating rather than the tweet from the president.

Falsifying social proof to provide legitimacy

To support the presence of these impersonation accounts and create a sense of legitimacy, scammers are leveraging other accounts to falsify social proof.

Many of the impersonators’ tweets have up to several hundred retweets and/or likes.

Unsurprisingly, however, many of these retweets and likes appear to be manufactured.

Looking at some of the likes associated with these tweets, we can make some observations. A subset of the accounts have no profile pictures, which typically signifies new or inactive user accounts or those who choose not to publish a profile photo. Their display names appear to be Russian.

If we look at some of these accounts, we can see they show minimal previous activity. Likely, they are abandoned Twitter accounts that were sold in an underground forum, or had weak passwords on their accounts, and have been repurposed by these scammers.

When digging into the likes associated with these accounts, we can verify they are primarily being used to like and retweet accounts associated with these fake giveaways.

Outside of likes and retweets, scammers are also using accounts to reply to these fake giveaway tweets, claiming they are legitimate.

These tweets often have hundreds of likes and retweets as well, once again as a way to provide falsified social proof.

Verified accounts compromised

I’ve observed some instances where the scammers have compromised verified accounts and use them to prop up these scam tweets.

For instance, the scammers compromised the account of Canadian radio and television personality Josie Dye and used it to claim the giveaway is an “official event.”

Recently, scammers used the Twitter account of The Florida Times-Union reporter Ann Friedman in the same way as Dye’s account to claim the giveaway was an “official event,” adding she “can confirm it.”

Clearly, neither of these verified accounts legitimately tweeted out support for these giveaways. But, the verified badge helps the scammers trick victims into believing their giveaways are real.

Historically, when scammers compromised verified Twitter accounts, they used them to pivot to impersonate Musk because the verified badge creates more of a sense of legitimacy. So, why aren’t scammers using these verified accounts to impersonate Elon Musk or President Trump directly? While I cannot confirm this, I suspect Twitter may have implemented some mechanisms to detect when a verified account suddenly changes its profile image and/or username to that of known public figures such as Musk. Therefore, the scammers are trying to preserve their access to these accounts, opting instead to leverage them to falsify social proof.

Pivoting from Musk to Trump

While Musk has proven to be a successful figure for scammers in their pursuit of stealing cryptocurrency, they’ve recently begun experimenting, pivoting away from Musk to President Trump.

I spotted a tweet from an impersonator of Jeff Tiedrich, a Twitter user who regularly replies to the president’s tweets. The Tiedrich impersonator’s tweet said, “God bless you Donald,” and included a photoshopped tweet that appeared to be from the president. What’s interesting about this tweet is it’s not fully photoshopped. President Trump actually tweeted about Bitcoin and cryptocurrencies back in July 2019.

I am not a fan of Bitcoin and other Cryptocurrencies, which are not money, and whose value is highly volatile and based on thin air. Unregulated Crypto Assets can facilitate unlawful behavior, including drug trade and other illegal activity....

— Donald J. Trump (@realDonaldTrump) July 12, 2019

Scammers have apparently repurposed this tweet and modified it to make it seem like President Trump started a giveaway for his followers who are “cryptolovers.” The fabricated tweet also includes a link to a newly registered domain, donaldcrypto[.]com.

Impersonation of other figures

In addition to these impersonations, I’ve seen impersonations of political commentators and other political figures associated with Trump. For instance, scammers impersonated political commentator Maria Bartiromo in response to a tweet regarding her interview with President Trump, pushing the same Musk “crypto party” giveaway.

Additionally, I’ve seen scammers impersonate Ronna McDaniel, chairwoman of the Republican National Committee, promoting the same photoshopped tweet used by the Bartiromo impersonator.

Replying to other political figures

While many of these cryptocurrency scam tweets operate within replies to President Trump, I’ve also seen tweets directed at other political figures, such as former President Barack Obama, members of Congress, political commentators and others.

President Barack Obama

Rep. Jim Jordan

Entrepreneur and Political Activist Kim Dotcom

Political Commentator John Solomon

As you can see in the example above, not every impersonator responds directly to the person they’re impersonating. It’s unclear if this is intentional or a bug in the process.

Additional observations

Not all the tweets followed the same template. For instance, one of the tweets had a different image with text that didn’t match up with the style of a real tweet. In the example below, the photoshopped image looks shoddy, as it does not align with Twitter’s design aesthetic and may have been a rush job.

In some cases, the impersonation accounts aren’t actually impersonating when they respond. In the example below, the “Emre” account is responding to Jeff Tiedrich, but it appears the account was never modified to include the name and avatar of Tiedrich in order to operate as an impersonator.

In some cases, I found the scammers would respond to their own tweets, either intentionally or unintentionally, which appears to me as some type of misconfiguration of whatever automated software the scammers are using to identify and respond to these tweets.

Lastly, I’ve seen instances where scammers tried to prop up these tweets with falsified social proof, but in doing so, they neglected to update their scripts.

In the example above, several of the tweets reference Tesla PR and Elon even though the photoshopped image is of President Trump. Only the last tweet shown actually mentions President Trump (“Pretty neat. This is official event from Trump.”).

A continuous cat-and-mouse game

There has been a perpetual cat-and-mouse game between Twitter and cryptocurrency scammers since they appeared in 2018, as scammers try to evade detection and removal of their accounts. As a result, scammers keep modifying their tactics in a variety of ways.

In the beginning, direct impersonation of notable figures was the intention. The impersonators’ tweets would contain Bitcoin and Ethereum cryptocurrency addresses. To combat efforts to remove their accounts, the scammers would thread their tweets, talking about the supposed giveaway in the initial tweet, followed by a secondary tweet linking users to an external website instead of listing the Bitcoin or Ethereum cryptocurrency addresses directly. Eventually, they pivoted away from including links directly in their tweets, opting instead to post the URL in an image. Recently, the scammers switched to bypassing that entire process, creating photoshopped tweets of notable figures that contained a URL to the supposed giveaway page.

Fake Medium pages for cryptocurrency scams

For external websites, scammers lifted the template from the popular publishing platform, Medium, using it to promote the so-called “official” giveaways from Musk and President Trump.

The scammers also create a fake “comment” section with posts from users claiming to have received Ethereum from the giveaway.

The same template was also used for the website, donaldcrypto.com. In this instance, the scammers forgot to update the link pointing to President Trump’s Twitter account, leaving it to point to Musk’s.

Verify address, double your cryptocurrency?

The principal part of the ruse is the scammers offer to double a user’s cryptocurrency. They ask users to send anywhere between 0.1 to 10 Bitcoin or Ethereum, promising to send them between 0.2 to 20 Bitcoin or Ethereum back. This is akin to the premise of “flipping,” which I talked about in my Cash App Friday scam blog series. The general concept is the same: You send money to “verify” yourself (or your cryptocurrency wallet address) and, in return, you receive more money than you sent. In this case, you supposedly double your cryptocurrency.

As you might expect, there is no giveaway. The promise of doubling your cryptocurrency is just a way for scammers to steal yours.

Impact of cryptocurrency scams

It’s hard to gauge the true impact of these scams based on the rotating cryptocurrency addresses and the potential for scammers to fake transactions by sending cryptocurrency to themselves. However, a recent Reddit thread shed light on a real example of a cryptocurrency enthusiast losing their cryptocurrency in one of these scams.

According to the thread, a user stumbled across one of these tweets containing a photoshopped tweet from Elon Musk. The user said they “frantically rushed” to send 0.4 Bitcoin, which was worth $3,000 at the time of the transaction, to the address. The user acknowledged that “after only a little digging it became very clear that I just got scammed.” Unfortunately, there are likely more cases like this that remain unreported.

Resist: Cryptocurrency scams persist

It’s clear from the previous example that there is enough incentive for scammers to continue to pursue these schemes on Twitter and other platforms, even if they don’t net large sums of cryptocurrency. So, we shouldn’t expect them to walk away anytime soon. They’re just participating in a continuous cat-and-mouse game with Twitter’s Trust & Safety team.

If you’re a Twitter user, you can help combat the scourge of scammers by reporting these fraudulent accounts to Twitter through their built-in reporting tools.

Here are a few options for reporting these accounts:

Report as Suspicious or Spam

Under the “It’s suspicious or spam” option, you can flag these scam accounts as “sharing links to potentially harmful, malicious or phishing sites.” Since they’re promoting photoshopped tweets with links in them, this is a great option.

Report as Impersonation

The other option is to report the accounts as impersonators. Navigate to the option “They’re pretending to be me or someone else” and specify that they’re impersonating someone else. It’s also helpful to have the username of the account being impersonated. In the case above, scammers are impersonating @mmpadellan. Adding that context will help Twitter when reviewing your report.

When asked what people can do, Musk himself encouraged reporting these accounts “as soon as you see it.”

Report as soon as you see it. Troll/bot networks on Twitter are a *dire* problem for adversely affecting public discourse & ripping people off. Just dropping their prominence as a function of probable gaming of the system would be a big improvement.

— Elon Musk (@elonmusk) February 1, 2020

Because this remains a game of cat and mouse, the x-factor in all this is the Twitter community. It’s up to Twitter users to participate in keeping the platform free from these scammers because as long as there is money to be made, they’re going to keep iterating and finding new ways to peddle their scams.

Understanding when and how to use vulnerability scans effectively can help you take a proactive approach to risk assessment. 

In this post, we’ll explore the role vulnerability testing plays within a larger risk assessment program.

Vulnerability testing is a type of risk assessment that looks for flaws in a network system, database, application or similar part of an IT configuration. Where standard penetration testing focuses on identifying points of weakness that need to be dealt with across an entire configuration, a vulnerability test is a more specific assessment that focuses on evaluating software flaws and identifying the risk implications of a vulnerability. 

For example, a surface-level penetration test can identify that an application vulnerability could allow an attacker to gain a foothold into the network. A vulnerability test can then identify the scope of the vulnerability, the systems an attacker could access and the damages that could be done in the event of a breach. This makes it easier to determine how urgently you must work to patch the vulnerability and push that update out to users. That is, of course, for software, but the same process extends to vulnerability analysis on networks or databases.

Why is vulnerability scanning essential?

Performing a vulnerability scan on an application or network is critical due to the increased persistence and sophistication of cyberattacks. On one hand, attackers are getting smarter all the time, looking for weak points and attacking them strategically. They are also getting more efficient and sophisticated in how they target businesses and consumers. 

What's more, increased complexity within IT configurations creates more attack vectors and security flaws for attackers to capitalize, both on the application and network layers. 

Businesses must develop strategies to get ahead of the attackers. It isn't enough to wait on a breach to identify vulnerabilities and take action. Regular vulnerability assessments are essential in identifying weak points and getting ahead of problems before they escalate. 

What does a vulnerability scan do?

A vulnerability scan assesses a network to identify vulnerabilities, including software flaws, missing patches, malware, and misconfigurations. Vulnerability assessment programs will take steps like:

• Analyzing metadata and configuration items throughout the IT setup to identify inconsistencies in the information. These data quality issues create risk by limiting visibility into assets and preventing IT teams from developing a proper understanding of their setup.
• Creating a comprehensive record of assets throughout the network, logging vulnerabilities in the configuration and monitoring unexpected changes to ensure constant visibility into potential weak points.
• Tracking data workflows within application environments to assess the command lines the app is running and the changes it is making to files in order to identify suspicious behavior and vulnerable code.

Modern vulnerability scanning isn't about performing an isolated one-time scan. It's a matter of constantly tracking the IT configuration to perform threat exposure analysis and identify gaps in the infosec strategies in place. In practice, a vulnerability scan is a visibility tool. It analyzes huge amounts of data, including lines of code, file commands and network configuration information to identify vulnerabilities. IT teams would likely be capable of identifying these vulnerabilities if they were looking at them – it's why many businesses got by with responsive, not proactive cybersecurity for so long – but the amount of data that businesses would have to parse through is far too great for manual analysis.

Vulnerability testing performs the data analysis legwork needed so your teams have the insights they need to identify threat exposure and take action to deal with weak points.

When are vulnerability tests most valuable?

Vulnerability testing is best used as an ongoing practice. Vulnerability scanning can position businesses to gain a deeper awareness of their cybersecurity weak points. Besides data breaches, some of the best catalysts for adopting vulnerability scans to create value potential are:

• Moving into DevOps: Creating stronger alignment between development and operations teams is, in most cases, followed quickly by an accelerated change and release cycle. Continuous integration is a common part of DevOps. The frequency of changes and releases in such settings can have a pronounced impact on risk exposure as new vulnerabilities emerge. Making vulnerability testing a key component of DevOps is key in keeping risk to manageable levels.
• Increasing cloud use: Branching out into hybrid and multicloud setups creates complexity and network vulnerability that requires stronger monitoring. Many businesses end up with blind spots in the cloud, something that vulnerability testing can help with.

These are just two examples that illustrate the growing importance of vulnerability testing tools. Any project in which IT teams are increasing configuration complexity can be a catalyst for getting serious about testing. While these examples may function as catalysts to invest in vulnerability scanning, the tools are essential for everyday cybersecurity operations. Don't neglect vulnerability assessments and find yourself with blind spots that limit your ability to protect your systems.

At Tenable, we can help you get as much value as possible from your vulnerability management efforts. Our tools bring next-generation visibility into IT configurations, helping businesses take a proactive approach to vulnerability testing as part of risk assessment. Get started today.

Get started now

Attackers are targeting a recently patched flaw in a popular WordPress plugin with over 1 million active installations.

Background

On February 12, Snap Creek, makers of the popular WordPress plugin Duplicator, released version 1.3.28 and Duplicator Pro version 3.8.7.1 to address a serious vulnerability.

Duplicator is a plugin used by WordPress site administrators to “migrate and copy WordPress sites.” According to statistics from WordPress.org, Duplicator has over 1 million active installations, and according to Snap Creek, it has been downloaded over 15 million times.

Analysis

According to researchers at Wordfence, an unauthenticated arbitrary file download vulnerability exists in Duplicator versions 1.3.26 and below and Duplicator Pro versions 3.8.7 and below.

The vulnerability exists due to the implementation of a pair of functions, duplicator_download and duplicator_init. The functions can be accessed by unauthenticated users because they were implemented using the wp_ajax_nopriv_ hook. Researchers note that because the functions were “hooked into init,” they would be executed on every WordPress page that’s loaded, whether the user is logged in or not.

Within these functions, the file parameter was sanitized but not validated, so an attacker could use path traversal to access files outside of Duplicator’s specified path.

An unauthenticated, remote attacker could exploit this vulnerability by sending a specially crafted request to a WordPress site using the vulnerable version of the Duplicator plugin. This would allow them to download files outside of the intended directory. An attacker would need some knowledge of the target file structure or attempt to download commonly known files.

These files could include the wp-config.php file, referred to as “one of the most important files” in a WordPress installation. This is because the configuration file contains database credentials and authentication keys and salts. An attacker could use this information to create their own administrator account on the vulnerable site or “inject content or harvest data.”

Wordfence has reportedly blocked over 60,000 attempts to download the wp-config.php file using this vulnerability. They note that of the 60,000 attempts, 50,000 occurred before February 12, prior to Snap Creek releasing a fix for the vulnerability, indicating this was exploited in the wild as a zero-day.

Proof of concept

At the time this blog post was published, there was no proof of concept (PoC) available for this vulnerability. However, there is enough information available in Wordfence’s blog post along with the indicators of compromise to easily craft a PoC.

Solution

Snap Creek addressed this vulnerability in Duplicator version 1.3.28 and Duplicator Pro version 3.8.7.1 on February 12. Duplicator and Duplicator Pro users are strongly encouraged to upgrade to versions 1.3.28 and 3.8.7.1 or greater as soon as possible.

Wordfence provided indicators of compromise to identify attacks exploiting this vulnerability. The bulk of the attacks they’ve seen originate from the following IP address:

• 77.71.115.52

Additionally, review HTTP logs for requests that include the following query strings:

• action=duplicator_download
• file=/../wp-config.php

The most reliable indicator is whether the request contains the file parameter, as that is required to exploit this vulnerability.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• Wordfence Blog Post
• WordPress Plugin Page for Duplicator
• Snap Creek Website for Duplicator

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Several proof-of-concept exploit scripts for recently patched flaw in Apache Tomcat are now available.

Background

On February 20, China National Vulnerability Database (CNVD) published a security advisory for CNVD-2020-10487, a severe vulnerability in Apache Tomcat’s Apache JServ Protocol (or AJP). AJP is a binary protocol designed to handle requests sent to a web server destined for an application server in order to improve performance.

Ghostcat logo created by Chaitin Tech

The vulnerability, dubbed Ghostcat, was discovered by researchers at Chaitin Tech and reported to the Apache Software Foundation on January 3, 2020.

Analysis

CVE-2020-1398 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).

Because AJP is enabled by default in the /conf/server.xml file in Apache Tomcat 6, 7, 8 and 9, all unpatched versions of Tomcat are vulnerable to Ghostcat.

Research community investigates

Apache Tomcat AJP Vulnerability (CNVD-2020-10487/CVE-2020-1938 ) .This vulnerability was discovered by a security researcher of Chaitin Tech .

You can read any webapps files or include a file to RCE .JUST A POC-GIF with no DETAILS

Tomcat has fix this vulnerability ,UPDATE! pic.twitter.com/Jauc5zPF3a

— Henry Chen (@chybeta) February 20, 2020

Henry Chen, a security researcher at Alibaba Cloud, published a tweet confirming that exploiting the vulnerability would allow someone to “read any webapps files or include a file to RCE.” Chen shared a GIF showing the successful exploitation of the vulnerability.

just for clarify: CVE-2020-1938 is NOT a default Remote Code Execution vul. It is a LFI. So, IF you can:
1) upload files via an APP feature &
2) these files are saved inside the document root (eg. webapps/APP/... &
3) reach the AJP port directly;
Thus, it can be turned in RCE.

— Joao Matos (@joaomatosf) February 21, 2020

Another security researcher, Joao Matos, confirmed that RCE is possible in cases where uploading files is a “feature,” that the uploaded files are “saved inside the document root,” and the AJP port can be reached directly.

Potential impact

According to a post in the Apache Software Foundation Blog from 2010, Apache Tomcat has been downloaded over 10 million times. Apache Tomcat is used by a variety of software applications, often bundled as an embedded web server. The potential impact of this vulnerability is wide, though we do not have the complete picture as of yet. As this information is still fresh, we anticipate additional details about its impact will become public in the coming weeks and months.

Proof of concept

Since the security advisory was published, several researchers have shared proof-of-concept exploit scripts [1, 2, 3, 4, 5] to GitHub.

Solution

Patch availability

Apache has released patches for several versions of Tomcat.

This vulnerability also reportedly affects Apache Tomcat 6, but Apache has not released a patch, as it is likely no longer supported. Users are strongly encouraged to upgrade to a newer version of Tomcat to ensure they’re protected against this vulnerability.

Mitigation

If patching is not feasible at this time, there are a few mitigation steps suggested by Chaitin Tech that can be taken to prevent exploitation of this vulnerability, since the AJP Connector is enabled by default.

If your site is not actively using the AJP Connector, simply comment it out from the /conf/server.xml file:

However, if you are using the AJP Connector on your site, you’ll need to ensure the AJP Connector contains the secretRequired attribute, which is akin to a password, so it needs to be strong and unique.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• Chaitin Tech's Ghostcat Page
• CNVD Security Advisory for CVE-2020-1398 (CNVD-2020-10487)
• Apache Tomcat 9.0 Changelog
• Apache Tomcat 8.5 Changelog
• Apache Tomcat 7.0 Changelog

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Google is aware of reports that a type confusion flaw in Google Chrome has been exploited in the wild.

Background

On February 24, Google released a new stable channel update for Google Chrome for Desktop to address several vulnerabilities, including one that has been reportedly exploited in the wild.

Analysis

CVE-2020-6418 is a type confusion vulnerability in V8, Google Chrome’s open-source JavaScript and WebAssembly engine. It was discovered and reported by Clément Lecigne, security engineer of Google’s Threat Analysis Group (TAG). Last year, Lecigne was credited with finding and reporting CVE-2019-5786, a use-after-free vulnerability in Google Chrome that was also exploited in the wild.

Google says it’s “aware of reports that an exploit” for this flaw “exists in the wild,” implying this may have been exploited as a zero-day.

Detailed information about the vulnerability isrestricted at this time. Further information about this vulnerability may become available in the future, after users have had time to apply patches. We will update this blog post if and when this information becomes available.

Proof of concept

While this vulnerability has been exploited in the wild, at the time this blog post was published, there was no public proof-of-concept available.

Solution

Googlereleased Chrome version 80.0.3987.122 for Windows, Mac and Linux to address CVE-2020-6418. Google also patched two additional vulnerabilities in this release, including CVE-2020-6407, an out-of-bounds memory access vulnerability and an integer overflow vulnerability that does not have an associated CVE identifier.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Stable Channel Update for Google Chrome (80.0.3987.122)

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Attackers are probing for vulnerable Microsoft Exchange Servers, as details surrounding a severe flaw were recently made public.

Background

On February 11, Microsoft released a patch for a severe vulnerability in Microsoft Exchange Server as part of its monthly Patch Tuesday updates. Initially, Microsoft labeled this a memory corruption vulnerability in Microsoft Exchange. However, Microsoft has since updated the title and description for the flaw.

Analysis

CVE-2020-0688 is a static key vulnerability in Microsoft Exchange Control Panel (ECP), a component of Microsoft Exchange Server. The use of static keys could allow an authenticated attacker with any privilege level to send a specially crafted request to a vulnerable ECP and gain SYSTEM level arbitrary code execution.

Microsoft rates this flaw as important, but notes that exploitation is more likely, according to its exploitability index.

Vulnerability details

According to researchers at the Zero Day Initiative (ZDI), Microsoft Exchange Server installations “have the same validationKey and decryptionKey” in the MachineKeySection of the web configuration (web.config). As the ZDI notes, these keys are used to secure server-side data stored in serialized form in the ViewState, which is included as part of the requests from the client in the “__VIEWSTATE” parameter. (If this sounds familiar, it’s because we recently blogged about an improper input validation vulnerability in Microsoft SQL Server Reporting Services that also involved serializing untrusted data through the VIEWSTATE parameter.)

To generate a malicious request, the attacker would need to obtain the following parameter values:

While the first two parameters are static and easily obtainable, the last two parameters require an attacker to log in to the vulnerable ECP instance with valid user credentials. Only then could the attacker capture these parameters from the HTML source and the cookie field in the request header.

Once an attacker has obtained these values, they can generate a serialized payload using ysoserial.net as part of their malicious request to a vulnerable ECP instance.

In their blog, the ZDI shared a YouTube video demonstrating exploitation of this flaw.

Valid user credential requirement

As part of a Twitter thread about the vulnerability, security researcher Kevin Beaumont noted that authentication is “not a big hurdle.” He also noted the availability of tools that can capture employee information from LinkedIn pages and use them to target Outlook Web Access (OWA) “with authentication attempts via credential stuffing.” Beaumont said the tools are “used in active attacks, to gain OWA and ECP access.”

There are open source tools which take the input of a company page on LinkedIn, dump all the employee names then hammer Outlook Web App with authentication attempts via credential stuffing.

These tools are used in active attacks, to gain OWA and ECP access.

— Kevin Beaumont (@GossiTheDog) February 25, 2020

Organizations behind in patching

Microsoft provides a way to identify Exchange Server build numbers through the login pages of OWA and ECP, enabling attackers to identify which servers are potentially vulnerable to CVE-2020-0688.

Beaumont found through “a quick sample” that organizations were “averaging in the years rather than months behind” in patching their Exchange Server instances, which is a major concern.

One additional thing - you can see the patch version of Exchange in the ECP and OWA login pages, so expect some sweeping of the internet for this (patch rates) in coming weeks.

I just did a quick sample, orgs are averaging in the years rather than months behind with Exchange.

— Kevin Beaumont (@GossiTheDog) February 25, 2020

Attackers probing for vulnerable Microsoft Exchange Servers

Soon after the ZDI’s blog post was published, attackers began probing for vulnerable Microsoft Exchange Servers.

Troy Mursch, chief research officer at Bad Packets, tweeted that “mass scanning activity has begun” for this vulnerability.

CVE-2020-0688 mass scanning activity has begun. Query our API for "tags=CVE-2020-0688" to locate hosts conducting scans. #threatintel

— Bad Packets Report (@bad_packets) February 25, 2020

Beaumont himself also identified mass scanning activity for the vulnerability based on data from BinaryEdge.

That was quick, since 2 hours ago seeing likely mass scanning for CVE-2020-0688 (Microsoft Exchange 2007+ RCE vulnerability). pic.twitter.com/Kp3zOi5AOA

— Kevin Beaumont (@GossiTheDog) February 25, 2020

Proof of concept

Details to craft a proof-of-concept for this vulnerability can be found in the ZDI’s blog post.

Solution

Microsoft released patches for this vulnerability during Patch Tuesday on February 11, 2020, for Microsoft Exchange Server 2010, 2013, 2016 and 2019. Though unconfirmed, this may also affect Microsoft Exchange Server 2007, which reached end of life in April 2017.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability can be found here.

Get more information

• Microsoft's Advisory for CVE-2020-0688
• The Zero Day Initiative's Blog on CVE-2020-0688

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

The year 2020 is shaping up to be a pivotal one for the U.S. Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program as it takes significant steps toward realizing the program vision of empowering federal agencies to make informed cybersecurity risk decisions and fix their worst problems first. 

The CDM program, administered by the U.S. Department of Homeland Security (DHS), delivers cybersecurity tools and services to all federal agencies. The year ahead represents a tipping point for this critical program in many ways. One of those ways, as described by CDM program manager Kevin Cox recently, is the ability to deliver actionable cybersecurity information through the CDM dashboard ecosystem, or what he characterizes as “operationalizing” CDM. 

Cox refers to FY2020 as a “readiness year,” in which federal agencies will become familiar with the concept of scoring their cyber risk and begin to evaluate their performance against a federal average. The CDM FY2020 to-do list includes establishing a federal baseline for AWARE algorithm scores for participating agencies and providing guidance to agencies on ways to improve boost AWARE scores by enhancing software patching practices and other measures. Each federal agency sees its own AWARE score and a federal average score. The CDM Program Office also sees the data and offers feedback to agencies on how to improve scores. 

So, what goes into an AWARE score anyway? While refinements are anticipated, AWARE 1.0 currently provides a raw risk score, which gives an agency a rough idea of its overall cyber risk. At a high level, according to the Cybersecurity and Infrastructure Security Agency (CISA), AWARE categorizes vulnerabilities in three ways:

• Software Vulnerability (VUL) – Individual CVEs (Common Vulnerabilities and Exposures) identified on network endpoints by vulnerability scanners
• Configuration Settings Management (CSM) – Vulnerabilities that fail a CSM check are scored by assigning a risk value within the Common Vulnerability Scoring System (CVSS) scale based on severity
• Unauthorized Hardware (UAH) – Hardware devices not assigned to a Federal Information Security Modernization Act (FISMA) container

AWARE then assigns scores for the above three categories of vulnerability based on four metrics:

• Base – The base CVSS (Common Vulnerability Scoring System) value, scaled to prioritize the worst problems first
• Age – Age measured from the CVE publication date, with impact increasing over time
• Weight – Weight incorporating threat intelligence and other inputs
• Allowable Tolerance – A “grace period” between the score appearing on the agency’s dashboard and the federal dashboard that enables the agency to patch before a vulnerability impacts its Federal AWARE score

The vision for AWARE is to become an essential tool for federal agencies to make informed risk decisions and fix their worst problems first. At Tenable, we call this risk-based vulnerability management, and we have designed our Risk-Based Vulnerability Management Solution to deliver the type of actionable information that DHS is hoping to achieve with AWARE. Every federal agency that receives AWARE data about vulnerability priorities can also receive Tenable risk-based vulnerability prioritization data through its Tenable.sc platform. Leveraging this investment can deliver a substantial head start in understanding how to fix the vulnerabilities that pose the most risk first, resulting in superior AWARE scores as well as a more secure environment. 

The Tenable Risk-Based Vulnerability Management Solution, like AWARE, includes CVSS data as a factor in its scoring. Recognizing the shortcomings of CVSS as a guide to vulnerability prioritization, however, the Tenable Risk-Based Vulnerability Management Solution goes far beyond CVSS to deliver a complete view that enables informed risk-based decision-making. The solution uses machine learning analytics to correlate vulnerability severity, threat actor activity and asset criticality to predict and manage issues posing the greatest risk. 

Effective risk-based vulnerability prioritization must identify the few vulnerabilities with the highest likelihood of being exploited and include asset criticality. Tenable automates this by using data science and machine learning models to analyze more than 150 factors and output two risk-based metrics: the Vulnerability Priority Rating (VPR) and the Cyber Exposure Score. The VPR combines multiple vulnerability severity and threat intelligence factors to determine the likelihood of a vulnerability being exploited. The Cyber Exposure Score takes this further and automatically calculates asset criticality to represent the impact and combines the asset criticality rating with the VPR to determine each vulnerability’s risk to the agency.

Perhaps most importantly, Tenable does not limit Cyber Exposure Score information to the enterprise or agency level. Organizations can configure the Tenable Risk-Based Vulnerability Management Solution to deliver actionable Cyber Exposure Score data at any desired organizational level, enabling an extremely granular view of the security posture within the agency, and helping agency decision-makers apply limited resources where they are most needed. This achieves the vision that Kevin Cox has expressed for AWARE to “get it down to the business system level.”

To learn more about risk-based vulnerability management, visit: https://www.tenable.com/solutions/risk-based-vulnerability-management

For insights into how to go beyond CVSS to enable informed risk-based prioritization decisions, read the ebook, Focus on the Vulnerabilities That Pose the Greatest Risk.

Vulnerability assessments are one of the best methods to take the pulse of your organization’s network security.

Consider for a moment the lifecycle of a vulnerability – of any size – in the security of the network infrastructure that your organization relies upon. If discovered by malicious online actors, they may choose to exploit it. They can implement everything from dedicated denials of service, which stun your organization's activities, to rootkits that allow more subtle, gradually destructive access. 

For that matter, information security teams lucky enough to find their company’s flaws first don't really have that much of a leg up: Tenable's research on this very subject found that malicious actors generally have between 5 and 12 days to throw all their exploits at a vulnerability before a business discovers it. Simply put: If a loophole isn't almost immediately patched upon its discovery, someone unwelcome will try to get through it. 

This is why vulnerability scans are so important. If you consider yourself a relative tech novice, you may be hearing all this and asking, "Wait, what is vulnerability assessment, anyway?" Fear not – we've got you covered. 

Vulnerability assessments gauge the effectiveness of cybersecurity measures

Vulnerability assessments examine the protective measures your organization has in place to safeguard its digital assets, catalogs the security flaws that exist and helps security teams understand what types of cyberattacks could most easily affect the network as a result of said flaws. 

Frequency matters – conduct assessments based on risk and industry

All organizations, be they in the public, private or nonprofit sectors, can benefit from completing vulnerability assessments. At an absolute minimum, you should do this weekly, and in today’s threat-rich environment, it may be worthwhile (and then some) to run such tests more frequently than that: every few days or even every 24 hours. 

You must also consider other factors when determining how often to carry out vulnerability assessments. One is your history of cyberattacks and breaches and perceived level of risk thereof. For example, if your network has been breached before – even if it was some time ago and you've addressed the specific vulnerability that led to the incident – it's probably best if you run scans for network flaws more often than an organization with no history of cyberattacks. 

Businesses operating in industries that have proven to be particularly vulnerable, such as finance and health care, should complete vulnerability assessments frequently. (Regulations such as HIPAA often dictate exactly how often such scans must occur.) One thing is for certain, regardless of industry or attack history, if you've never run a vulnerability scan before, it's imperative to do so now.

Strive to be diligent (and never settle for minimalism)

In a world where data breaches have evolved from an esoteric threat to a fairly commonplace danger and network vulnerabilities are multiplying like never before, the importance of vulnerability assessment cannot be overstated. Cybersecurity should never be something where you “set it and forget it.” 

However, some businesses do just that. Tenable Research's Cyber Defender Strategies report surveyed more than 2,100 organizations and found that 33% of them could be considered “minimalist” in terms of how they conducted their vulnerability assessments. This means scans were carried out only as a compliance mandate, in a one-system-at-a-time format. Only 5% of respondents were “diligent,” covering all assets comprehensively and in a differentiated fashion to address varying use cases. 

Nessus Professional from Tenable can help you strive for diligence in your network security by providing you with comprehensive vulnerability assessment across all assets. 

Start your free trial now

At Tenable, we like to say, “What we do matters.” This commitment doesn’t only apply to our cybersecurity solutions, but also our culture. We care about what we do, each other and the communities we serve.

Last year, I cofounded Tenable’s first-ever Diversity and Inclusion Council, which brings together company leaders who believe in creating an environment that:

• Helps all employees feel welcome and empowered
• Improves the work we do
• Ensures we have a strong talent pool to close the cyber exposure gap across the world

Senior leadership at Tenable has long understood the value of diversity and inclusion as a key step in pipelining the future cyber workforce at our company – and throughout the industry. Their support of these goals has made the Tenable Diversity and Inclusion Council not only possible, but extremely rewarding. 

Insights from Professor Harry Wingo

In celebration of Black History Month, I had the pleasure of hosting a fireside chat with Professor Harry Wingo. Harry is a full-time faculty member at the National Defense University's College of Information and Cyberspace and a champion of diversity throughout the industry. His insights and views gave our team important new perspectives. As we’re well aware, the cybersecurity industry faces a severe talent shortage – and the issue is only getting worse. As recent global and national events have shown, we need smart, talented cybersecurity experts from different backgrounds to effectively tackle these challenges.

Expanding STEM initiatives for the future cybersecurity workforce

Harry shares my excitement for growing cybersecurity diversity and inclusion. However, we need a strong workforce to support the jobs created here in Maryland and across the globe. That’s why much of our discussion focused on the importance of diversity and inclusion for the future workforce, but also the opportunities to expand to STEM initiatives. These types of initiatives will be key going forward – we must limit the obstacles that future generations face.

Being present for the next generation

To grow that diverse talent pool, we need to foster relationships and show the next generation of the cyber workforce there are people like them in the industry and we’re here to build them up and bring them along. Like Harry said during our discussion, we must be a man or woman for others. We must be mentors and willing to show others that being black – or any other minority – in the cybersecurity field is a possible and prosperous career choice, and there are others like them who are successful.

Flexing defenses in an ever-changing environment

One of the questions the Tenable team asks any new customer is, “How secure is your organization?” Tenable solutions look for vulnerabilities the customer might have missed and translate cyber risk into actionable business decisions. With Harry’s experience as a Navy SEAL, however, he saw the question differently. Harry often found that risk is on a continuum – and you’re never completely secure. You can mitigate your risk, but you can never eliminate it. Harry likened this to a wrestling match – you’re always “on” and working to prepare for your opponent’s next move. And he’s right – the reality is threat landscapes are always changing, and our defenses must be equally strong but elastic.

Keeping the conversation going

The cybersecurity industry is in desperate need of diversity, and we have a long way to go. But, having a candid conversation about the challenges the industry faces, the adversity minorities have faced and how we can do better was a great way to spend a morning during Black History Month, and the Tenable team is better for it. There is much to do, but we’re making important progress, and we hope to host similar discussions in the future.

Last week, thousands of security-minded professionals descended on downtown San Francisco for the annual RSA Conference. Monday, February 24, featured a Public Sector Day event, which kicked off the big week with a distinct government security focus. The 400-plus crowd of federal/state/local government officials, security specialists and other interested attendees were treated to a number of informative and instructive keynotes, breakout sessions, and panel presentations. Here are the highlights. 

Three superior keynotes

Sean Plankey, principal deputy secretary of energy, Office of Cybersecurity, Energy Security, and Emergency Response (CESER), kicked off the morning with a talk titled, “What Happened to Manual Mode?” He outlined some of the groundbreaking measures, such as “Cyber Force” events at strategically located universities, which his department is taking to address the acute operational technology (OT) cybersecurity skills gap.

Bradford Willke, Cybersecurity and Infrastructure Security Agency (CISA) assistant director (acting), spoke about the importance of increasing cyber awareness in government agencies, driving investments that will yield improvements and operationalizing public/private partnerships. Echoing the RSA Conference “Human Element” theme, Willke highlighted the CISA "Partnership as a Service" mindset in collaborating with, and supporting, federal, state and local governments in the battle against cybercrime. 

Anne Neuberger, NSA cybersecurity director, delivered encouraging remarks about the increasing level of collaboration between NSA and CISA. Neuberger spoke about her desire to share threat intelligence with key partners, pointing to the recent unprecedented NSA disclosure of the Windows 10 vulnerability as an example of increasing collaboration. 

Multiple federal, state, and local government breakout sessions

These sessions covered a wide swath of cyber-centric topics, with election security, ransomware and supply chain security concerns among them. Recurring themes included the need to effectively manage cyber risk in a challenging resource environment and the importance of engaging and collaborating with public- and private-sector stakeholders across the board. As attacks move to include industrial as well as IT targets, this collaboration will need to extend to a broader population to protect our nation’s critical infrastructure.

A capstone CIO/CISO panel

Wrapping up the packed agenda was an insightful CISO and CIO perspectives panel, moderated by Tenable’s CSO Bob Huber, which featured federal and state government IT security executives offering their diverse views on challenges, threats and opportunities in addressing cyber risk. 

Texas CISO Nancy Rainosek painted a vivid portrait of the pervasive impacts of the 57 ransomware attacks Texas experienced in 2019. Paul Cunningham, CISO, U.S. Department of Veterans Affairs, discussed challenges in managing his agency’s broad (over 1.3M endpoints) and diverse attack surface – from running the largest U.S. healthcare network to providing financial services to deliver veterans benefits to managing over 25K acres of public land. In his agency, cyber is now on the main risk agenda. Huber summarized by saying, “Given the dialogue of the panelists, security and risk leaders at the national and state levels, limited resources and federated organizations demand a prioritized approach to risk management from a strategic and tactical level. It is evident that basic cyber hygiene is difficult, and even that often times requires a prioritized approach.”

Elsewhere at the RSA Conference, CISA director Christopher Krebs provided an election security update in a presentation that also included his admission that CISA had been “a little late to the game on ransomware” as they were sharply focused on nation-state actors like China and North Korea. He reported increasing CISA involvement with ransomware defense and strongly advised against paying any ransoms.

Final thoughts on RSAC 2020

All in all, the government discussion at RSAC 2020 painted a picture of growing cyber threats in a resource-constrained environment, driving the need for increasingly efficient and collaborative risk-based defensive measures and creative training and skills development approaches. At Tenable, we are responding to these realities with a risk-based vulnerability management strategy that optimizes vulnerability prioritization for a particular IT or IT/OT environment and delivers actionable insights to support informed risk-based decisions. We invite you to learn more: https://www.tenable.com/solutions/vulnerability-management

Multiple widely used Linux distributions are impacted by a critical flaw that has existed in pppd for 17 years.

Background

On March 4, researchers at the CERT Coordination Center (CERT/CC) published vulnerability note #782301 for a critical vulnerability in the Point-to-Point Protocol Daemon (pppd) versions 2.4.2 through 2.4.8, with disclosure credited to Ilja van Sprundel of IOActive.

The Point-to-Point Protocol (PPP) is a full-duplex protocol that enables the encapsulation and transmission of basic data across Layer 2 or data-link services ranging from dial-up connections to DSL broadband to virtual private networks (VPNs) implementing SSL encryption. PPP is also used to implement IP and TCP over two directly connected nodes, as these protocols do not support point-to-point connections. pppd is a daemon on Unix-like operating systems used to manage PPP session establishment and session termination between two nodes.

Analysis

CVE-2020-8597 is a buffer overflow vulnerability in pppd due to a logic flaw in the packet processor of the Extensible Authentication Protocol (EAP). An unauthenticated, remote attacker who sends a specially crafted EAP packet to a vulnerable PPP client or server could cause a denial-of-service condition or gain arbitrary code execution. As pppd works in conjunction with kernel drivers and often runs with high privileges such as system or even root, any code execution could also be run with these same privileges.

According to CERT/CC’s vulnerability note, the logic flaw exists in several EAP functions.

In the eap_request and eap_response functions, a pointer and length are received as input using the first byte as a type. If this type is EAPT_MD5CHAP(4), it looks at an embedded 1-byte length field. This check was implemented to ensure the embedded length is smaller than that of the entire packet length. And if the check passes successfully, then the hostname located after the embedded length is copied into a local stack buffer. The vulnerability is in the logic of how these functions parse the code. If the bounds check is incorrect and proceeds to copy memory with an arbitrary length of data, a stack buffer overflow is possible.

The eap_input function contains an additional flaw in its code that fails to validate if EAP was negotiated during the Link Control Protocol (LCP) phase within PPP. Essentially, regardless of whether the failure to validate was the result of an incorrect pre-shared passphrase during the LCP phase or due to a lack of support for EAP, an unauthenticated attacker could send an EAP packet that would be processed. The processing of this unverified EAP packet can result in a stack buffer overflow.

Proof of concept

At the time this blog post was published, there was no working proof-of-concept (PoC) for this vulnerability.

However, multiple GitHub repositories have been published that may soon host a working PoC. One appears to be a work-in-progress, while another claims that a PoC will be released for this vulnerability “in a week or two when things die down.”

Solution

The vulnerability was patched in eap.c on February 2. Various Linux distributions have since released updates to address the vulnerability in PPP and additional patches may be released in the coming days. The following is a list of known distribution releases that address this vulnerability:

Additionally, Cisco has assigned CSCvs95534 as the bug ID associated with this vulnerability as it reviews the potential impact it may have on its products.

This is not an exhaustive list, and we anticipate more vendors will publish advisories as they determine the impact of this vulnerability on their products.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability can be found here.

Get more information

• CERT/CC Vulnerability Note #782301 for CVE-2020-8597

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Zoho releases a patch for a critical remote code execution flaw in ManageEngine one day after the vulnerability was publicly disclosed.

Background

On March 5, Steven Seeley, an information security specialist at Source Incite, published an advisory for a vulnerability in Zoho ManageEngine Desktop Central. Desktop Central is a centralized management solution for a variety of devices – from personal computers (e.g., desktops, laptops) to mobile devices (e.g., smartphones, tablets). The vulnerability affects Desktop Central build 10.0.473 and below.

Analysis

CVE-2020-10189 is an untrusted deserialization vulnerability in Zoho ManageEngine Desktop Central. The vulnerability stems from an improper input validation in the FileStorage class. According to Seeley, an unauthenticated, remote attacker can abuse the lack of validation in the FileStorage class to upload a malicious file containing a serialized payload onto the vulnerable Desktop Central host. To trigger the untrusted deserialization, an attacker would then need to make a subsequent request for the file uploaded onto the vulnerable host. This would then grant the attacker arbitrary code execution with SYSTEM/root privileges. For more detail, please refer to the proof-of-concept section, which contains Seeley’s detailed breakdown of the vulnerability.

https://t.co/cCOrj1t6bo - "only" 2300+ of these online.....

— Nate Warfield (@n0x08) March 5, 2020

According to a Shodan search by Nate Warfield, senior security program manager at Microsoft, there are over 2,300 publicly accessible Desktop Central instances.

Proof of concept

Along with his advisory, Seeley published a proof-of-concept (PoC) for the vulnerability, which he shared in a tweet.

Solution

Zoho released a patch on March 6 to address this vulnerability in Desktop Central build 10.0.479. Users are strongly encouraged to patch as soon as possible by visiting ManageEngine’s service pack release page. The page also includes a link to download build 10.0.479.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• SRC-2020-0011: Source Incite Advisory for CVE-2020-10189
• SRC-2020-0011: Source Incite Proof-of-Concept for CVE-2020-10189

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

When it comes to automotive manufacturing, industrial control systems (ICS) may be the weak link inviting new types of attacks. Here’s what you need to know.

Auto manufacturing has become an increasingly popular target today for industrial cyberattacks. Since 2016, the number of annual incidents has increased by 605%, with incidents more than doubling in 2019 alone.¹ One reason – advances and changes in OT have opened up new attack vectors and surfaces. 

Advances in OT invite new attacks

Legacy ICS in the automotive industry has proven to be durable, but this durability has become a security risk in today’s connected world. Most of the original operational technology (OT) networks servicing the automotive industry were not built with security in mind, simply because there was little security risk. They consist of equipment originally designed to be “air-gapped,” in other words totally isolated – electromagnetically, electronically and physically – from all networks, including local systems and the internet, especially those that weren't secure. However, the convergence of IT and OT, combined with the rapid adoption of IIoT, has yielded new attack vectors that were previously not possible. 

Cybersecurity challenges in auto manufacturing

Several conditions make auto industry ICS vulnerable:

1. Modern auto assembly lines are connected to IT. Integration between IT and OT systems can create blind spots, which means a breach in one system can create a gateway into the other.
2. Most car components and parts are made using digital technology.
3. Many vehicle components are digitally manufactured outside the assembly plant by third-party manufacturers. This extends vulnerability beyond the assembly plant to all manufacturing facilities and the plants of all supply chain partners. They are susceptible to the same risks as the main auto manufacturing plant.
4. Connected cars are always connected – and thus always vulnerable to attacks, making them potential targets even after the manufacturing process is completed.
5. Assembly operations are turned over every model year, exposing them to new security threats.
6. Auto manufacturing requires constant uptime. It’s estimated that 1 minute of downtime costs automotive manufacturers $22,000 per minute or $1.3 million per hour. Some estimates run as high as $50,000 per minute.²

Mitigate core risks through full OT visibility, security and control 

Full visibility

To mitigate OT risks, you need full visibility into all the operational assets that control sourcing, fabrication and assembly processes. Deep knowledge of all types of devices in the OT network – including patch levels, firmware versions and backplane information – is essential. Also, account for dormant devices not communicating regularly over the network. You can do this at your organization’s main location via an on-premises physical device. 

Be sure to establish OT security at all sites, so that remote locations have the same mitigation as the main campus. If sites are too small or remote to accommodate additional gear, consider deploying a cloud-based solution. In addition, live feeds can identify new security threats and enable a real-time OT security posture.

Vulnerability prioritization and control 

Due to the strict production schedule and cost of downtime in automotive manufacturing, it’s difficult to stop operations to apply patches when a vulnerability is discovered or even to perform routine maintenance. To ensure vulnerability windows are closed in a timely manner, an effective OT security system should perform regular inventory checks that provide details, including device model numbers, firmware versions, vulnerabilities, patch levels and more. These checks will pinpoint the devices that require maintenance when the plant can be idled and allow for targeted and prioritized operations procedures in the meantime.

Effective security and threat detection

When it comes to threat detection, the most effective process combines multiple detection engines:

• Traffic mapping and traffic visualization: Identifies policy violations and alerts on instances in which a given policy (e.g., blacklisting, whitelisting) is violated.
• Anomaly detection: Pinpoints traffic patterns outside regular network operation.
• Signature-based detection: Identifies published threats and leverages crowd-sourced alerts of previously unidentified threats.

IT/OT cybersecurity solutions can help you mitigate risk

Want to learn more about how you can overcome OT security challenges? Tenable.ot (powered by Indegy) can help by providing capabilities such as:

• A multidetection engine that employs both passive detection and patented active querying to detect any threat to your network – on your main campus and remote sites
• An up-to-date and detailed inventory list that helps identify, manage and prioritize vulnerabilities and plan maintenance schedules
• Sitewide audit information that can speed incident response and demonstrate proactive regulatory compliance

Download the solution brief

_{1. 2020 Automotive Cybersecurity Report, Upstream Security
2. True Cost of Factory Downtime: How Downtime Affects Productivity,” Simutech, 2019}

Microsoft's March 2020 Patch Tuesday addresses an extraordinary 115 CVEs, including 58 elevation of privilege flaws.

Microsoft addresses 115 CVEs in the March 2020 Patch Tuesday release, following February's 99 CVEs. Of these 115 CVEs, 26 were rated as critical. This update contains patches for 31 remote code execution flaws as well as 58 elevation of privilege vulnerabilities which accounts for nearly half of all reported CVEs this month. This month’s patches include Microsoft Windows, Microsoft Office, Microsoft Edge, Internet Explorer, ChakraCore, Microsoft Exchange Server, Azure DevOps, Windows Defender, Visual Studio, Microsoft Office Services and Web Apps, Azure and Microsoft Dynamics. The following is a breakdown of the most important CVEs from this month’s release.

CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0847, CVE-2020-0848, | Scripting Engine Memory Corruption Vulnerability

CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0847, and CVE-2020-0848 are remote code execution (RCE) vulnerabilities in the ChakraCore scripting engine in Internet Explorer and Microsoft Edge. The vulnerabilities vary in their exploit conditions and scope, but in each case, an attacker can gain remote control of a vulnerable host by manipulating how Microsoft browsers handle objects in memory. Users are encouraged to apply all the relevant patches to reduce risk.

CVE-2020-0684 | .LNK Remote Code Execution Vulnerability

CVE-2020-0684 is an RCE vulnerability in Microsoft Windows that can be exploited during the processing of a .LNK file to execute arbitrary code. An attacker who successfully exploits this flaw could gain the same user rights as the local user. To exploit the vulnerability, an attacker could give a user a removable drive or provide the user with a remote share that contains the malicious .LNK file and a malicious binary. When the user opens the share or the drive with an application that parses the .LNK file, the malicious binary would then execute. To correct this issue, the security update addresses the processing of shortcut .LNK references.

CVE-2020-0881 and CVE-2020-0883 | GDI+ Remote Code Execution Vulnerability

CVE-2020-0881 and CVE-2020-0883 are RCE vulnerabilities due to the way in which the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who exploits either of these flaws could take control of an affected system. Two common attack scenarios include a web-based attack where an attacker convinces a user to visit a malicious website or a file-sharing scenario that involves an attacker convincing a user to open a specially crafted file. As the attack scenarios would require some user interaction, Microsoft rates these as ‘Exploitation Less Likely.’

CVE-2020-0801, CVE-2020-0807, CVE-2020-0809 and CVE-2020-0869 | Media Foundation Memory Corruption Vulnerability

CVE-2020-0801, CVE-2020-0807, CVE-2020-0809 and CVE-2020-0869 are memory corruption vulnerabilities that exist when Windows Media Foundation improperly handles objects in memory. To exploit these flaws, an attacker would need to convince a user to open a crafted file or visit a malicious website. Successful exploitation would allow an attacker to install applications, change or delete data, or create new users with full user privileges.

CVE-2020-0850, CVE-2020-0851, CVE-2020-0852, CVE-2020-0855 and CVE-2020-0892 | Microsoft Word Remote Code Execution Vulnerability

CVE-2020-0850, CVE-2020-0851, CVE-2020-0852, CVE-2020-0855 and CVE-2020-0892 are RCE vulnerabilities within Microsoft Word when the application fails to properly handle objects in memory. To exploit any of these vulnerabilities, an attacker would need to convince a user to open a specially crafted file. An attacker who successfully exploits this flaw could then take actions on behalf of the logged-in user with that user's same permissions. One important item to note is that CVE-2020-0852 can be exploited simply by viewing a crafted file in the Preview Pane of Microsoft Outlook.

CVE-2020-0777, CVE-2020-0797, CVE-2020-0800, CVE-2020-0864, CVE-2020-0865, CVE-2020-0866 and CVE-2020-0897 | Windows Work Folder Service Elevation of Privilege Vulnerability

CVE-2020-0777, CVE-2020-0797, CVE-2020-0800, CVE-2020-0864, CVE-2020-0865, CVE-2020-0866 and CVE-2020-0897 are elevation of privilege vulnerabilities in the Windows Work Folder Service due to improper handling of file operations. An attacker who exploits this flaw could run a process with elevated permissions. To exploit this, the attacker would need to be logged in as a lower-privileged user.

CVE-2020-0788, CVE-2020-0877, CVE-2020-0887 | Win32k Elevation of Privilege Vulnerability

CVE-2020-0788, CVE-2020-0877, CVE-2020-0887 are a trio of elevation of privilege vulnerabilities in Win32k due to the improper handling of objects in memory. Successful exploitation of these vulnerabilities would grant an attacker the ability to run arbitrary code in kernel mode. From there, the attacker could use their elevated privileges to create new user accounts with full rights, view, modify or delete data, or install programs on the compromised system. Elevation of privilege vulnerabilities are leveraged by attackers post-compromise, after they’ve managed to gain access to a system to execute code on their target systems with elevated privileges.

Tenable solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains March 2020.

With that filter set, click the plugin families to the left, and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s March 2020 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

• Microsoft's March 2020 Security Updates
• Tenable plugins for Microsoft March 2020 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.