Critical unpatched “wormable” remote code execution (RCE) vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3), dubbed EternalDarkness, disclosed by Microsoft.

Background

On March 10, Microsoft published ADV200005, an advisory for a critical RCE vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3). Details about this vulnerability were originally disclosed accidentally in another security vendor’s blog for March’s Microsoft Patch Tuesday. Soon after their blog post was published, the vendor removed reference to the vulnerability, but security researchers already seized on its accidental disclosure.

Microsoft eventually acknowledged the vulnerability publicly and published its advisory for it.

Microsoft is aware of a RCE vulnerability in the way that the SMBv3 protocol handles certain requests. If you wish to be notified when updates for this vulnerability are available, please follow the guidance in the advisory linked here: https://t.co/x5Z658xQ6t

— Security Response (@msftsecresponse) March 10, 2020

Analysis

Microsoft did not assign a CVE identifier for this vulnerability in ADV200005. However, the accidental disclosure of the vulnerability had identified it as CVE-2020-0796.

According to Microsoft, the vulnerability exists in the way the SMBv3 handles certain requests. For SMBv3 Server, an unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to a vulnerable SMBv3 Server. For SMBv3 Client, an attacker would need to convince a user to connect to a malicious SMBv3 Server they’ve configured.

Successful exploitation of the vulnerability would grant the attacker arbitrary code execution in both SMB Server and SMB Client.

Based on an intrusion prevention system (IPS) rule released by FortiGuard Labs, the flaw appears to stem from a buffer overflow vulnerability, which occurs due to an error in the handling of compressed data packets.

Image source: Fortiguard Labs Threat Encyclopedia

This latest vulnerability evokes memories of EternalBlue, most notably CVE-2017-0144, an RCE vulnerability in Microsoft SMBv1 that was used as part of the WannaCry ransomware attacks. It’s certainly an apt comparison, so much so that researchers are referring to it as EternalDarkness. However, there is currently little information available about this new flaw, and the time and effort needed to produce a workable exploit is unknown.

it's okay the official Gossi name is EternalDarkness which doesn't sound super weird at all

— Kevin Beaumont (@GossiTheDog) March 10, 2020

Proof of concept

At the time this blog post was published, there was no proof-of-concept (PoC) available.

Solution

The following versions of Microsoft Windows and Windows Server are affected.

There is currently no patch for this vulnerability. However, Microsoft has provided workaround instructions as part of their security advisory. These workaround instructions include a PowerShell command that disables compression for SMBv3 Server to prevent attackers from exploiting the vulnerability.

In addition to disabling compression, Microsoft advises blocking inbound and outbound traffic on TCP port 445 on the perimeter firewall. The Computer Emergency Response Team Coordination Center (CERT/CC) also advises verifying that SMB connections from the internet “are not allowed to connect inbound to an enterprise LAN.”

While these workarounds will prevent exploitation of SMBv3 Server, it is important to note that SMBv3 Client will remain vulnerable until a patch is available and applied.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released. In the interim, customers can utilize the following plugins to build a list of systems that may be affected and require applying the Microsoft recommended mitigations:

Plugin ID 106716: This plugin will report on the SMB Dialects Supported as shown in the output below.

Additionally, you can include plugin ID 11936 in your scan policy to verify the operating system (OS) installed.

Get more information

• ADV200005: Microsoft Security Advisory for SMBv3 Remote Code Execution Flaw
• CERT Coordination Center Vulnerability Note, VU#872016

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Malware and phishing campaigns use global interest in the novel coronavirus to capitalize on fear and uncertainty around the pandemic.

Background

In December 2019, reports of an outbreak of a new virus and disease, dubbed COVID-19 by the World Health Organization (WHO), began to emerge. COVID-19 is a novel coronavirus, which has captured global attention and is now considered a pandemic. Since December, COVID-19 has spread to more than 100 countries, with cases being reported every day. With such intense interest in the disease and the uncertainty around it, cybercriminals have found COVID-19 serves as the perfect lure to target users in a variety of ways, including leveraging it as part of malicious emails to phish users and spread digital viruses.

Coronavirus-themed malware campaigns

Emotet campaign

At the end of January 2020, researchers began observing attempts to distribute the Emotet malware in emails targeting users in Japan using COVID-19 as the lure.

新型コロナウイルス関連をテーマにした #emotetのばらまきメール。
昨日と本日で確認どちらも日本語に違和感はありません。

■件名
添
■添付ファイル
別添.doc

■件名
別添 01.29
■添付ファイル
取扱説明書.doc pic.twitter.com/r6Ra3eZf2l

— bom (@bomccss) January 29, 2020

IBM’s X-Force team compiled some indicators of compromise on January 29 and published a summary blog post on February 5. Emotet is part of a chain of three malware strains dubbed the Triple Threat by researchers at Cybereason. Emotet is responsible for bringing the TrickBot trojan into compromised environments, and TrickBot has been identified as a precursor to a Ryuk ransomware infection.

#Ryuk is one of possible payloads delivered by human operators that enter networks via Trickbot. The Trickbot implant downloads Cobalt Strike or PowerShell Empire and begins to move laterally, activating the Trickbot infection for #ransomware deployment: https://t.co/brO143JpO1pic.twitter.com/TWmjEB7fcT

— Microsoft Security Intelligence (@MsftSecIntel) March 10, 2020

AZORult trojan

Researchers at Proofpoint published a blog post on February 10, highlighting a unique malicious spam campaign leveraging the genuine concerns around COVID-19 and its impact on global shipping.

Image source: Proofpoint blog

The malicious Microsoft Word document found in this email exploits CVE-2017-11882, a memory corruption vulnerability in Microsoft Office’s Equation Editor component.

Once exploited, the AZORult trojan is installed on the compromised system. AZORult is an information-stealing trojan first identified in 2016, which exfiltrates sensitive data from a compromised system.

On March 9, researchers at Reason Labs observed cybercriminals continuing to use COVID-19 concerns to spread AZORult again.

Image source: Reason Labs blog

The cybercriminals distributed a fake version of the Johns Hopkins Coronavirus Map in the form of a malicious executable. However, it is unclear whether they used malicious email or social media to distribute this malicious executable.

Nanocore Remote Access Trojan (RAT)

On February 13, researchers from the Cisco Talos team published a blog post highlighting how threat actors were capitalizing on the coronavirus outbreak. It began by referencing the Emotet campaigns discussed earlier. However, they also found campaigns using COVID-19 fears to distribute the Nanocore RAT.

Image source: Cisco Talos blog

The malicious email subject read, “Coronavirus Update: China Operations” and the contents discuss the impact of COVID-19 on a company’s operations in China with a malicious attachment inside a ZIP file. The email references a company, but it is unclear whether the cybercriminals repurposed part of a genuine company email or wrote it themselves.

Lokibot trojan

On February 14, IBM X-Force researchers shared details about another coronavirus-themed malicious spam campaign, this time targeting users in China. According to IBM X-Force, the malicious spam campaign claimed to be from the Ministry of Health of the People’s Republic of China.

Image source: IBM X-Force Exchange

The email uses official imagery and addresses the user by the username component of their email address. The email provides so-called precautions to “stay safe as death toll keeps increasing” and contains a malicious attachment, referred to as an “Emergency Regulation Ordinance Against Coronavirus,” in the form of an .arj file, a Windows RAR archive file. Once the attachment is opened, it results in a Lokibot trojan infection. Lokibot trojan is an information stealer, keylogger and more that first appeared as a password and cryptocurrency wallet stealer in 2015 on hacker forums. 

TrickBot trojan

On March 4, researchers at Sophos published a blog post about a malicious spam campaign targeting users in Italy with a list of precautions they can take to prevent the infection of COVID-19.

Image Source: SophosLabs blog

The email contains a malicious Word document that includes a Visual Basic for Applications script responsible for downloading the TrickBot trojan.

Coronavirus-themed phishing attacks

In addition to COVID-19 themed malware campaigns, cybercriminals are also leveraging the threat in traditional phishing campaigns.

On February 7, researchers at Kaspersky published a blog post detailing a phishing campaign that claimed to originate from the U.S. Centers for Disease Control and Prevention (CDC).

Image source: Kaspersky blog

This phishing email says the CDC is closely monitoring the COVID-19 outbreak and established an “Incident Management System'' for coordinating the public health response both domestically and internationally. It appears to include a link to a cdc.gov webpage. However, this link actually directs users to a website that looks like a Microsoft Outlook page. The page contains a username and password prompt for users to log in. It is an attempt by the cybercriminals to steal login credentials, as they hope to gain access to these accounts and start pouring through emails, looking for valuable information.

On March 5, researchers at Check Point Software Technologies published a blog post identifying newly registered domain names that included the word coronavirus in them. Since January 2020, Check Point researchers say they’ve identified over 4,000 of these so-called coronavirus domains. They found 3% of these domains were malicious, while 5% were suspicious. Check Point says these domains are “50% more likely to be malicious” than other domains registered during this time period.

Warnings from WHO, FTC and CISA

 The WHO,  the U.S. Federal Trade Commission (FTC) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have published advisories warning consumers about the threats posed by cybercriminals seeking to capitalize on the fear and uncertainty surrounding COVID-19. See below:

• WHO: Beware of criminals pretending to be WHO
• FTC: Coronavirus: Scammers follow the headlines
• CISA: Defending Against COVID-19 Cyber Scams

Stay informed about digital threats related to COVID-19

As we’re still in the earliest stages of the COVID-19 outbreak, it’s important to understand that these types of attacks will continue for the foreseeable future. Cybercriminals love to prey on the fears and uncertainty surrounding major global events, and as COVID-19 continues to pose a threat, cybercriminals will continue to leverage it as part of their campaigns.

The best way to protect yourself against digital threats leveraging the interest in COVID-19 is to stay informed. If you receive an email about COVID-19, be skeptical, especially if it contains an attachment. Visit your local government health organization’s or WHO’s website for the latest information about COVID-19.

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 30-day trial of Tenable.io Vulnerability Management.

For more than two decades, customers have been at the very heart of everything we do at Tenable. We take the trust you place in us very seriously, and we understand that the work we do matters to you and to your ability to protect your business.

We would like to reassure you that, as of this moment, we do not anticipate disruption from COVID-19 on our ability to deliver Tenable’s solutions to our customers anywhere in the world. We have developed thoughtful procedures for responding to emergencies and maintaining business continuity, and have convened a COVID-19 task force to review developments and adjust our approach as information comes to light. Our platform infrastructure has redundancy built-in to continue to maintain our uptime Service Level Agreements. In addition, our Technical Support experts will continue to be available for you 24 hours a day, 7 days per week. We are available via the Tenable Community, phone, email and chat. Please refer to our Technical Support page for more information.

Tenable has always embraced a distributed workforce and has long empowered our employees to work remotely. We’ve invested in a technology infrastructure that enables our employees to work securely and effectively from any location in the world, and have practiced doing so for some time. Our rapid response to last week’s security advisory from Microsoft, including our delivery of a plugin for the remote code execution vulnerability within a matter of hours, was a good example of our globally distributed and remote teams delivering with agility and speed.

In moments like these, transparent communication is more critical than ever. Please don’t hesitate to reach out to us on how we can best support your crisis needs. We are here to support you and will maintain open communications with our entire community of customers, partners and employees as the situation continues to evolve. 

Attempts to exploit multiple vulnerabilities in Trend Micro Apex One and OfficeScan observed in the wild.

Background

On March 16, Trend Micro published a security bulletin to address five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan, including two vulnerabilities that were exploited in the wild. Trend Micro Research is credited with the discovery of these vulnerabilities.

Analysis

Multiple vulnerabilities exploited in the wild

CVE-2020-8467 is a vulnerability in Apex One and OfficeScan in a component of a migration tool. A remote, authenticated attacker could exploit this vulnerability and gain arbitrary code execution on affected Apex One and OfficeScan installations.

CVE-2020-8468 is a vulnerability in the Apex One and OfficeScan agents as a result of a content validation escape. An authenticated attacker could exploit the vulnerability to “manipulate certain agent client components.”

Trend Micro says they are aware of “at least one active attempt” to exploit these vulnerabilities in the wild. Details about these exploitation attempts are unknown.

Additional critical vulnerabilities patched

In addition to these two vulnerabilities, Trend Micro patched three other critical vulnerabilities that do not require authentication.

CVE-2020-8470 is a vulnerability in Apex One and OfficeScan server due to the presence of a vulnerable service DLL file. Exploitation would grant an attacker SYSTEM level privileges, allowing them to delete any file on the server.

CVE-2020-8598 is another vulnerability in Apex One and OfficeScan server due to the presence of a vulnerable service DLL file. A remote, unauthenticated attacker could exploit this vulnerability and gain arbitrary code execution with SYSTEM level privileges.

CVE-2020-8599 is a vulnerability in Apex One and OfficeScan server due to the presence of a vulnerable executable file. Exploitation of this vulnerability would grant an attacker the ability to bypass ROOT login and allow them to "write arbitrary data to an arbitrary path" on the system.

Trend Micro assigned the maximum CVSS score of 10 to these three vulnerabilities, though they note they are unaware of attempts to exploit them in the wild.

Attackers target OfficeScan

This isn’t the first time attackers have targeted Trend Micro products. In October 2019, Trend Micro published a security bulletin for CVE-2019-18187, a directory traversal vulnerability in OfficeScan. According to their bulletin, they had observed active attempts to exploit the flaw in the wild.

Customers running these products should be aware that attackers will continue to exploit these vulnerabilities and search for other, undiscovered vulnerabilities in these products.

Proof of concept

At the time this blog post was published, there was no proof-of-concept code available for any of the vulnerabilities patched.

Solution

Trend Micro released fixes for Apex One and OfficeScan. The following table contains a list of affected versions and the associated patched version.

Customers running vulnerable versions of Apex One and OfficeScan should apply these patches as soon as possible.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• March 16, 2020: Trend Micro Security Bulletin for Apex One and OfficeScan
• October 28, 2019: Trend Micro Security Bulletin for OfficeScan

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

The worldwide fear and uncertainty surrounding the novel coronavirus isn’t just being leveraged in malware and phishing attacks, as it has also enabled the spread of misinformation, fake cures and a variety of scams.

Last week, we reported on the rise in malware and phishing attacks using the COVID-19 virus, which continues to dominate headlines worldwide. As it remains top of mind, it’s no surprise that COVID-19 has become a hotbed for misinformation, scams and fake cures.

If you're selling fake cures for coronavirus, installing malware in apps designed for people to track the spread of the virus or posing as the CDC or WHO in phishing emails, the DOJ is coming after you. AG Barr directed all U.S. attorneys today to prioritize these prosecutions.

— Mike Balsamo (@MikeBalsamo1) March 16, 2020

It’s become so problematic that the Attorney General of the United States has instructed the Department of Justice to prioritize prosecuting those responsible for distributing fake cures, malware and phishing attacks and other scams leveraging the coronavirus pandemic.

Cash App scammers leverage COVID-19

In October 2019, I wrote a blog series about opportunistic scammers targeting legitimate giveaways from Cash App, the popular person-to-person (P2P) payment application. In the months since, the scammers’ activities have continued, but with all the attention surrounding COVID-19, the Cash App scammers have started leveraging it as well.

Some Cash App scammers are simply adding the #coronavirus hashtag to their tweets in order to ride the hashtag.

In another instance, a Cash App scammer referenced the impact of the “Corona Virus” and how it is “cancelling” everything except “are (sic) bills.” They then propose their offer: $2,000 to the first 300 people to retweet their tweet, allegedly offering a grand total of $600,000 in a giveaway. This tweet also references another P2P application, Apple Pay. They reference it because not everyone uses Cash App, but there are a lot of Apple iPhone users. The tweet also includes the hashtags “#CoronavirusOutbreak” and “#CoronaVirusUpdate” instead of anything Cash App related.

Finally, another Cash App scammer uses both the “#COVID19” and “#CoronavirusOutbreak” hashtags along with a “#CashappMonday” hashtag. The tweet implies that because of the virus, they’re sending money to users. In this case, the first 500 people could receive anywhere between $300 to $1500. This tweet struck a chord with users on Twitter, receiving over 675 retweets and 963 likes at the time I observed it.

All three scenarios center around money flipping. The Cash App scammers claim they can flip transactions, turning a small denomination of $10 into $100, for example. They claim they can modify the transactions in post through the P2P application, whether it be Cash App, Paypal, Zelle, Venmo or Apple Pay. All they ask for is that the recipient share the initial cut with them for providing them this so-called service. As you might expect, the victims won’t receive anything in return. They’ll be left high and dry after parting ways with their money.

Misinformation around COVID-19 is a growing problem

Social media provides a valuable avenue for real-time information on current events, such as the situation surrounding COVID-19. At the same time, it enables the dissemination of misinformation.

The FBI & @LASDHQ seek info regarding the party responsible for posting a false document online suggesting coronavirus is present in #Carson, CA. @lapublichealth has declared document to be fake. Have info? Please contact the FBI at 3104776565 or LASD at https://t.co/tISMu6J02Cpic.twitter.com/gw7XCuOBgU

— FBI Los Angeles (@FBILosAngeles) February 10, 2020

In late January, a fake document began circulating that falsely claimed cases of COVID-19 were detected in the city of Carson, California. This document contained official logos of the World Health Organization (WHO), U.S. Centers for Disease Control and Prevention (CDC) and Los Angeles County Department of Public Health. The Los Angeles Police Department tweeted on February 10 that they were “seeking information” on the party responsible for spreading this misinformation.

Rumors of a nationwide quarantine in the United States

One of the biggest pieces of misinformation to circulate through text and social media are screenshots of text messages claiming that the United States will be instituting a nationwide shutdown or quarantine for an extended period of time. These text messages claim that the original author spoke to a relative or someone who had connections to someone “really high up in the government” or the CDC, as a way of legitimizing their claims.

While the premise varies, the intention is the same – spread misinformation about the possibility of a nationwide quarantine.

To set the record straight, the U.S. National Security Council (NSC) tweeted that these text message rumors were fake. “There is no national lockdown,” the NSC said.

Text message rumors of a national #quarantine are FAKE. There is no national lockdown. @CDCgov has and will continue to post the latest guidance on #COVID19. #coronavirus

— NSC (@WHNSC) March 16, 2020

Offers of fake COVID-19 test kits

In Toronto, Canada, there are reports that scammers have begun knocking on doors, claiming to offer COVID-19 test kits. This report was identified and debunked in a tweet from Toronto’s fire chief, Matthew Pegg.

We have reports of scammers going door to door (and now apparently online) in Toronto selling “COVID-19 test kits”. This is a total scam. For accurate info, go to https://t.co/TrjscAlgBM@cityoftoronto@TOPublicHealth@epdevilla@bradrossTO

— Matthew Pegg (@ChiefPeggTFS) March 17, 2020

Fake messages from government agencies

The Australian Cyber Security Centre reports that Australians should keep an eye out for scam texts alleged to be from the Australian government, offering advice on “symptoms and when to get tested” along with a link to a website, http://covid19-info[.]online.

Watch out for scam texts claiming to be Australian Government advice on COVID-19 testing, which are aimed at stealing your bank details. Read more: https://t.co/9A6qswOmZnpic.twitter.com/Md4QIAyye8

— Australian Cyber Security Centre (@CyberGovAU) March 16, 2020

In our previous blog post about COVID-19, we referenced a report from Check Point Research that found that since January, 4,000 domain names including the word “coronavirus” had been registered. The example above supports that outside of “coronavirus,” scammers are registering domains containing “COVID19.” Creating domain names using phrases like coronavirus and COVID19 are used to present false legitimacy when sharing these as part of malicious emails, text messages or social media posts, so that when users receive them, they might be more inclined to trust them because they have these keywords in them. We expect more domains using these terms to be registered along with fake websites getting published, as scammers and cybercriminals continue to take advantage of the pandemic.

Unsolicited phone call scams

In Alberta, Canada, there are reports that Canadian residents are receiving unsolicited phone calls, claiming they have tested positive for COVID-19, followed by a request for credit card information.

In a tweet, Alberta Health Services debunked the claim, saying they would never ask for credit card information.

AHS will never call & ask for credit card information. Please hang up immediately and report by calling the non-emergency line for local law enforcement.

— Alberta Health Services (@AHS_media) March 17, 2020

In Alameda County, California, the sheriff’s office was notified by a victim who received a phone call from a scammer claiming that a loved one had been diagnosed with COVID-19 and was in an accident on their way to a hospital. The scammer said this loved one was arrested and needed to be bailed out to the tune of $13,000. The scammer would “send a friend” to collect the bail money.

Coronavirus Scam: We had our first scam where victim received a phone call saying loved one had Covid-19 and was in accident on way to hospital. The loved one was arrested for accident and needed $13k bail. Suspect said they would send friend to pick up money. Be aware!

— Alameda County Sheriff (@ACSOSheriffs) March 13, 2020

In Daly City, California, the police department says it is aware of scams where people are claiming to be from the CDC. These scams claim to offer reservations for a COVID-19 vaccine and require “a credit card and/or social security number.” The Daly City Police Department debunked these claims, saying there is no such “vaccine reserve program.”

New scam: People are claiming to be from the CDC offering to let people "reserve a vaccine for the COVID-19" with a credit card and/or social security number. There is no vaccine reserve program, and the CDC is not offering anything of the sort. Do not fall prey!

— Daly City Police (@DalyCityPD) March 17, 2020

Fake offers of emergency money for essentials

With talk of an economic stimulus along with checks being sent to U.S. citizens to provide a boost during the COVID-19 pandemic, scammers have seized on this narrative.

A Twitter user named Austin tweeted an image of a text message claiming to offer “emergency money for groceries.”

The fact that some people are trying to capitalize on COVID-19 and use it as a way to scam others just shows how evil and heartless humans are, and it’s heartbreaking. pic.twitter.com/aV1KbiULdo

— Austin (@Austin__13) March 17, 2020

Users who click the link in the text message are redirected to a website that claims to offer cash from as low as $1,000 to as much as $5,000.

Further information on the website reveals that it’s designed to put the visitors in touch with lenders to secure a loan. The scammers are likely referring users to this lender website to earn a referral bonus.

Work from home/job opportunity scams

The impact of COVID-19 has created challenges for those seeking work, while also adding uncertainty around existing work and the possibility of lost wages. As social distancing has been strongly encouraged by WHO and CDC, it makes it difficult to find work. As a result, this has become another area ripe for scammers, as they utilize COVID-19 to peddle job opportunity scams.

Brian Krebs recently reported that COVID-19 “widens the money mule pool” for scammers. A money mule is a person who transfers illegal money on behalf of criminals and keeps a commission fee for their efforts.

Krebs reports that a fraudulent website called Vasty Health Care Foundation, a fake Canadian foundation, copied most of its content from globalgiving.org. According to GlobalGiving’s chief product officer, Kevin Conroy, these fake job offers appear to be originating from job search websites like Indeed.com and Monster.com. While this report was focused on the fraudulent Canadian foundation, Krebs also learned that similar tactics are being employed to target Americans, according to Alex Holden, founder of Hold Security.

A Twitter user shared a post reportedly from the El Camino Police Department stating that students at El Camino College in Torrance, California, are being targeted by job opportunity scams “under the guise of working at home due to the COVID-19 outbreak.”

Fake cures and misinformation circulates on WhatsApp

One of the other major areas of concern surrounding the fear and uncertainty of COVID-19 are fake cures and other false information spreading through popular messaging applications like WhatsApp.

A lot of fake cures have been circulating through WhatsApp messages throughout India. An example of such a fake cure claims that a bowl of freshly boiled garlic water has proven to be effective.

Image source: Al Jazeera

Another viral WhatsApp message provides a so-called breathing exercise to help determine whether or not one has COVID-19. It also suggests taking “a few sips of water every 15 mins at least” because drinking liquids will “WASH them down through your oesophagus (sic) and into the stomach,” claiming that stomach acid will “kill all the virus.” These false claims have been debunked.

These are just some of the myriad of fake cures circulating on WhatsApp, from drinking lots of hot water, eating more ginger or increasing one's intake of vitamin C to more elaborate solutions.

Another WhatsApp message claims that placing cloves, cardamom, camphor and mace in a cloth and keeping it in one's pocket at all times is a remedy that will prevent “not just coronavirus, but no other virus will be able to harm you.”

A fake message claiming to be from the United Nations Children's Fund (UNICEF) mentions that avoiding ice cream and cold foods can protect against the virus. This message was debunked by UNICEF in a statement on their website from their deputy executive director for partnerships, Charlotte Petri Gornitzka.

Image source: Al Jazeera

Politico recently reported an audio recording was gaining traction through WhatsApp. The message claimed the Medical University in Vienna found patients who experienced the most severe symptoms from COVID-19 had been taking ibuprofen, a commonly used painkiller. This message was soon debunked by Johannes Angerer, spokesperson for the university. However, there are valid questions surrounding how ibuprofen affects COVID-19 patients, which are being looked into by the WHO.

Italy, which has been hit hard by COVID-19, has also seen an uptick in misinformation and fake cures being spread through WhatsApp, according to the BBC.

Fighting back against coronavirus scams and misinformation

As countries around the world fight back against COVID-19, the fear and uncertainty provides an excellent hook for scammers and peddlers of misinformation. We expect these will persist for quite some time.

The WHO has published information on the basic protective measures for the general public to combat the COVID-19 virus. The recommendations include:

• Wash your hands frequently
• Maintain social distancing
• Avoid touching eyes, nose and mouth
• Practice respiratory hygiene
• Seek medical care if symptoms (fever, cough, difficulty breathing) are present

Steps to take to help thwart misinformation, fake cures and scams around COVID-19

As we all work on our personal hygiene and practice social distancing, we can also play our part to help prevent the spread of misinformation and fight back against scammers.

1. Seek out information from trusted sources. WHO, CDC and other local health organizations are the most trustworthy places to get your information about COVID-19. Additionally, trusted news sources can also be a great place to gather information.
2. Be skeptical of phone calls and text messages around COVID-19. Scammers are counting on the fear and uncertainty around this virus to help fuel their efforts to steal money and sensitive information from unsuspecting individuals. Unsolicited phone calls and messages that you didn’t opt-in for are more than likely scams, so chances are you should simply ignore the messages.
3. Recognize that work-from-home job opportunities are most likely scams. If you come across a job opportunity that claims you can earn lots of money by working from home, it’s likely fraudulent, especially if they ask you to transfer money and keep a cut for yourself. There’s no such thing as easy money.
4. Consult your medical professional to get care. Offers to provide you with a test kit via door-to-door salesmen or over the phone are fake. If you have questions about your symptoms and are seeking advice about getting tested, contact your primary care physician. If your symptoms are severe, call your local emergency services.
5. Avoid forwarding messages on WhatsApp or other social media about so-called cures or news related to COVID-19. The cures being shared around WhatsApp aren’t rooted in any science and should not be a replacement for the recommendations outlined above from WHO. Forwarding these messages helps disseminate misinformation. Be skeptical of news that’s also being shared across these platforms. Be sure to verify the news being shared with you to ensure it hasn’t been fabricated.
6. Remember that on social media and text messages, free money isn’t free. Even with discussions about providing economic relief in the U.S., elaborate offers for money aren’t free. Scammers will ask you to provide some money upfront before they “flip” it into a larger denomination, but you won’t receive anything in return. Scammers will also try to direct you to websites to fill out surveys and/or install mobile applications, with the promise of earning some money in return. These are just ways to turn you into a cog in the wheel for the scammers to steal money from you.

This is just the beginning, not only for COVID-19, but for scams leveraging it. We fully expect these scams will continue to grow and change accordingly as new information is made available publicly. While we’ve tried to capture some common themes we’ve identified in misinformation and scams surrounding COVID-19, know there are many that we’ve not yet observed or contemplated. The best way to deal with this fact is to remain skeptical.

Join Tenable's Security Response Team on the Tenable Community.

Many of us around the globe are now experiencing the new reality of a large remote workforce virtually overnight. We're here to help our customers manage the new risks.

We are suddenly facing new cyber risks created by a surge in remote employees who may use personal assets for business or be more susceptible to phishing during times of crisis. To reduce the risk of this new attack vector, we all need to extend our security measures and include remote workers and devices as part of our enterprise vulnerability management programs.

Many customers have asked for guidance in handling the security of the assets used by remote workers. To support you through these changing and uncertain times, Tenable is helping you immediately extend your Tenable.io licenses for free, through April 30. For Tenable.sc and Nessus Professional customers, we are offering a free Tenable.io license with unlimited agent scanning for 30 days. In either case, we will help customers rapidly deploy agents across remote workers’ personal assets and manage these devices as part of your Tenable deployment. Please contact your customer success manager to learn more and get started.

In addition, Tenable will also be providing free weekly sessions with our principal engineers via Zoom to our customers around the globe. These sessions will include tips on how to set up agent scanning on remote assets, deployment best practices and a 30-minute Q&A session with our specialists to help address specific queries. Here’s more information.

We also encourage you to join our webinar on March 27 to better Understand and Address the Cybersecurity Impacts of COVID-19. Additionally, we will publish more resources to guide you in setting up agent scanning on our blog shortly.

Thank you for being a Tenable customer. As always, we are here for you.

Looking to secure a sudden influx of remote workers? Here are five steps to get started using Tenable agents. 

As organizations worldwide respond to the COVID-19 pandemic, cybersecurity professionals are grappling with the challenge of how to quickly secure remote workforce assets. Tenable customers have the option of installing lightweight, low-footprint agents locally on assets to supplement network-based scans. You can use these agents to collect vulnerability, compliance and system information and report that data back to your vulnerability management platform for analysis. 

Additionally, agents can increase your scan flexibility. They allow you to assess assets that are frequently offline (and thus invisible to active scans) by using large scan windows for when assets eventually connect to the network. You can also use agents to scan online assets without the need for ongoing host credentials while minimizing the network impact from large-scale concurrent scans.

Here are five steps to get started using agents to protect your remote assets and reduce your organization’s cyber risk. 

Get started with agents in five steps

If you’re new to agents, it’s easy to get started. Here are five simple steps to deploy agent-based scans in your environment. While Tenable supports agents in both Tenable.io and Tenable.sc, I’ll use Tenable.io to cover specific product examples. Please note: Tenable.io users will need administrator or scan manager role access and Tenable.sc users will need security manager role access to configure agent synchronization from Tenable.io.

Step 1: Retrieve the linking key

Before you install and deploy the agent, you will need to find the linking key to link agents to your vulnerability management platform to retrieve and analyze agent data. In Tenable.io, you can access this key by selecting Settings in the main navigation drop-down menu and clicking the Sensors option. From the Sensors screen, click Add Agent in the top right corner, which will display the Linking Key.

Step 2: Install Nessus Agents

Once you have the linking key, visit the Nessus Agents page to download the appropriate agent for your OS. Once downloaded, you can quickly and easily install them on your system. Nessus Agents support all major Linux distributions, Microsoft Windows and Mac OS. Use the installation wizard to complete the installation process or deploy agents via Command Line Interface (CLI). Additionally, you can consult our Large-Scale Deployment Guide to help you deploy a large number of agents (10,000+) across hosts in your organization.

Step 3: Verify Nessus Agents are linked

Now, make sure you can locate your newly installed and linked agent in Tenable.io. To verify its status, go to the Sensors screen in Settings and find your agent in the Linked Agents table. Once the agent shows it’s “Online,” you’re ready to configure your agent scan. Make sure you add your agent to an existing agent group or create a new Agent Group, so you can use it in future agent scans.

Step 4: Configure your agent scan

Create a new agent-based scan in Tenable.io by clicking the main navigation drop-down menu and selecting the Scans option under Tools. In the Scans screen, click the Create Scan button on the top right corner and select the Agent tab toward the top of the screen. Here, you can select from a variety of pre-configured scan templates, but the Basic Agent Scan is a great start for most users. 

Configure the scan based on your requirements, including several agent-only options such as Agent Groups and Scan Window. Pro tip: Select your scan window based on how persistent the asset’s connection is to the network. For remote laptops and workstations, it makes sense to use longer scan windows (12 hours for daily scans) to allow more time for those systems to report results when they access the network. Also, make sure to schedule the scan to run at regular intervals. Tenable.sc users may choose to sync agent scan results to Tenable.sc.

Step 5: Analyze scan results

Now you should see asset and vulnerability data from your agents flowing into Tenable.io and syncing to Tenable.sc. You can drill into dashboards or click agent scans to view specific agent results. You can even create specific dashboards and reports analyzing agent-based scan information. 

Additional resources

I hope these five steps are helpful to start your agent scanning journey. Here are additional resources to help you along the way:

• Nessus Agent User Guide
• Tips for Large-Scale Nessus Agent Deployments
• Nessus Agents FAQ
• Nessus Agents Whitepaper
• How-To Videos
• Tenable.io: Link an Agent to Tenable.io (in the Classic UI)
• Tenable.io: Agent Assessments in Tenable.io (in the Classic UI)
• Tenable.io: Use a Linking Key in Tenable.io
• Tenable.sc: Launch an Agent Scan in Tenable.sc

Microsoft releases an out-of-band advisory for remote code execution vulnerabilities being actively exploited in the wild.

Background

On March 23, Microsoft released an advisory for two vulnerabilities in Adobe Type Manager (ATM) Library, an integrated PostScript font library found in all versions of Windows. Although the name of the ATM library came from an Adobe developed tool, ATM Light, Microsoft included native support for the ATM fonts with the release of Windows Vista in 2007. These vulnerabilities therefore exist within Windows’ native integration for support of PostScript fonts.

To be clear and despite its name, this is *not* Adobe code. Microsoft was given the source code for ATM Light for inclusion in Windows 2000/XP. After that, Microsoft took 100% responsibility for maintaining the code.

— Rosyna Keller (@rosyna) March 23, 2020

Exploitation of these vulnerabilities could result in code execution on affected systems. Users are urged to implement Microsoft’s suggested workarounds to reduce risk until a patch is available.

Analysis

At the time this blog post was published, there were no assigned CVE identifiers for the two vulnerabilities in Microsoft’s advisory. According to the advisory, an attacker could gain code execution on a vulnerable machine after a user on that machine opened a specially crafted document or viewed that document in the Windows Preview pane.

The vulnerabilities exist within the way that Windows parses OpenType fonts. Successful exploitation would require an attacker to convince a user to open a malicious document or visit a malicious page that exploits the WebClient service which is normally listening for WebDAV file shares.

Proof of concept

There are no known public proofs of concepts available for these vulnerabilities at this time, but Microsoft notes it is aware of “limited targeted attacks” exploiting these vulnerabilities in the wild.

Vendor response

Microsoft released its advisory outside of the normal update cycle to provide workarounds, noting that a fix is forthcoming.

Solution

Microsoft offers several workarounds, including disabling the Preview pane and Details pane in Windows Explorer, disabling the WebClient service and renaming the Adobe Type Manager Font Driver dll file (ATMFD.dll). For the full details on the workarounds and their impact, please review the Workarounds section of the advisory. Organizations should deploy those workarounds as necessary.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released. Tenable will release plugins once a patch is available from Microsoft, which is expected to be released on April’s Patch Tuesday based on Microsoft’s wording in the FAQ section of Microsoft’s advisory.

Get more information

• Microsoft Advisory for ADV200006

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Over the last year, Gartner Peer Insights received reviews from 176 Tenable customers representing various roles, organizations and industries. Here’s a look at what they had to say about how Tenable solutions address key security challenges.

Tenable was named a March 2020 Gartner Peer Insights Customers’ Choice for Vulnerability Assessment for the second year in a row, more five-out-of-five-star ratings than any other vulnerability assessment vendor as of March 20, 2020.

Below are a few excerpts:

“[Tenable.io] Meets My Needs Now And In The Future.”

“Tenable.io meets all my immediate needs and has the capabilities to meet future needs and use cases.”– Manager, application security, $30B+ transportation firm

“[Tenable.sc] Rocks!!!”

“The Management Dashboard is very useful and Top management is getting insight knowledge about their infrastructure.”– Manager, security and risk management, $3–$10B financial firm

“Easy To Use And Configure”

“We needed to switch to a new vulnerability management tool when BeyondTrust announced they were getting out of the v-m business, and even they recommend Tenable. I see why - they are the industry leader and deserve to be. I wish we'd switched a long time ago.”– Analyst, network and infrastructure, $500M–$1B transportation firm

What is the vulnerability assessment market?

According to Gartner, the vulnerability assessment market consists of “vendors that provide capabilities to identify, categorize and manage vulnerabilities.” These vulnerabilities include:

• Unsecure system configurations
• Missing patches
• Other security-related updates in the systems connected to the enterprise network, remotely or in the cloud

We’re grateful for our awesome customers

On behalf of the entire Tenable team, a giant thank-you to our customers for taking the time to share your feedback. Your comments help us understand what’s working – and, just as importantly, what’s not. We have utmost respect for the trust you place in us, and learn from you every day.

In case you’re wondering, Gartner Peer Insights Customers’ Choice is based on customers’ views of the market’s highest-rated vendors. It’s determined by both the number of reviews (minimum of 50) and overall rating (minimum of 4.4 out of 5). Gartner verifies every review before publishing, to ensure its authenticity, with 1 (lowest) to 5 (highest) stars given based on various criteria: evaluation and contracting, integration and deployment, service and support, and product capabilities.

“Once again, the market has spoken. Customers trust and rely on Tenable to solve some of their biggest cybersecurity challenges and we think being named a Gartner Peer Insights Customers’ Choice is a direct testament to our leadership in this space,” said Renaud Deraison, Tenable co-founder and CTO. “We want to extend a huge thank you to all of our customers who shared their experiences and who continue to rely on our Cyber Exposure solutions to help them understand and reduce their cyber risk.”

Learn more about vulnerability assessment

• Read the blog post, “How to Choose the Right Vulnerability Management Solution”
• Download the ebook, Focus on the Vulnerabilities That Pose the Greatest Risk
• See the full list of vendors in the March 2020 Gartner Peer Insights Customers' Choice for Vulnerability Assessment

The GARTNER PEER INSIGHTS CUSTOMERS’ CHOICE badge is a trademark and service mark of Gartner, Inc., and/or its affiliates, and is used herein with permission. All rights reserved. Gartner Peer Insights Customers’ Choice constitute the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology; they neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates.

As COVID-19 drives many government agencies to quickly migrate from a centralized to remote workforce, new cybersecurity questions arise. Here are steps government agencies can take to manage these new cyber risks. 

Formerly office-bound employees are using personal devices in today’s necessity-driven remote work environment, introducing new BYOD challenges. This immediate expansion of the attack surface introduces new uncertainties and increased risk, raising important questions:

• How can we manage and secure these new assets?
• How can we make sure cybersecurity gaps don’t emerge in such an uncertain environment? 
• How can our security team keep up with the explosion of assets and vulnerabilities?

These types of questions must be addressed promptly and directly to prevent the potentially catastrophic consequences of cyberattacks. Here are some steps government agencies can take right now to manage these new cyber risks. 

#1. Take stock of newly connected remote assets, including personal devices 

Knowing where your organization is potentially exposed means knowing all your assets. With so many employees teleworking, it’s imperative to understand which new devices are now connecting to the network, even if intermittently. This is especially important given the sudden increase in virtual meetings. One immediate step Tenable customers can take is to use Nessus Agents to expand their visibility into the expanded attack surface and quickly assess new, unprotected assets, including personal laptops, phones and more, which are likely not part of the company’s security or vulnerability management program.

Nessus Agents are lightweight scanners you install locally on hosts to supplement traditional network-based scanning or to provide visibility into assets missed by traditional scanning. They collect vulnerability, compliance and system data and send that information back to a manager for analysis. You can scan hosts without using credentials and run large-scale concurrent agent scans with little network impact.

Although Nessus Agents provide a subset of the coverage in a traditional network scan, they can be useful if you need to:

• Scan transient endpoints that are not always connected to the local network. With schedule-based traditional network scanning, these devices are often missed, causing gaps in visibility. Nessus Agents allow for reliable compliance audits and local vulnerability checks to be performed on these devices, providing some visibility where there previously was none.
• Scan assets for which you do not have credentials or could not easily obtain credentials. When installed on the local system, Nessus Agents can run the local checks.
• Improve overall scan performance. Since agents operate in parallel using local resources to perform local checks, the network scan can be reduced to just remote network checks, speeding scan completion time.

#2. Focus on cyber hygiene fundamentals

As change accelerates and new challenges emerge daily, it is beneficial to stop and review the basics. We revisited past Tenable advisories regarding the importance of maintaining sound cyber hygiene in state, local, tribal and territorial governments, and found these important and still relevant top five priorities that provide another way to look at the challenges of the current situation:

1. Count: Know what’s connected to – and running on – your network (as discussed in #1 above, this is the primary and most important step)
2. Configure: Implement key security settings to help protect your systems 
3. Control: Limit and manage those who have admin privileges for security settings 
4. Patch: Regularly update all apps, software and operating systems 
5. Repeat: Regularly revisit these top priorities and your organization’s security policy to form a solid foundation of cybersecurity 

Now, more than ever, sharpening the focus on these basic cybersecurity fundamentals is the most essential action a government agency can take to protect its network environment.

#3. Focus first on what matters most

Even in the best of times, patching every vulnerability in every network device is an impossible dream. In the current environment, with networks expanding and resources being strained to the breaking point, many vulnerabilities are likely to remain unpatched for prolonged periods of time. But, here’s the good news: You don’t have to patch every vulnerability to effectively reduce your risk. You just need to patch the vulnerabilities that matter. Predictive Prioritization can help you become more secure by guiding you to the vulnerabilities that matter most.

Predictive Prioritization is a data science-based process that goes beyond CVSS and re-prioritizes each vulnerability based on the likelihood it will be leveraged in a cyberattack. Predictive Prioritization assigns a Vulnerability Priority Rating (VPR) for every disclosed vulnerability, including vulnerabilities that have yet to be published in the U.S. National Vulnerability Database (NVD). Now, here’s even better news: If you are a current Tenable.sc or Tenable.io customer, you already have this capability. To learn more about it, and for help in getting the most out of what you already have, please ask your Tenable customer success manager or join our office hours. 

More information to help secure government telework

Working to adapt your vulnerability management efforts to effectively secure growing telework environments? Here are resources to help you:

• Join Tenable security engineers for biweekly discussions about vulnerability management best practices for securing remote employees and operations
• Tune into the March 27 webinar (or post-event recording), "Understand and Address the Cybersecurity Impacts of COVID-19"
• Read the how-to blog post on getting started with Nessus Agents
• Review telework guidance from the U.S. National Institute of Standards and Technology (NIST) 

For Tenable.io and Tenable.sc customers

For more information on securing your remote workforce, read the blog post, “We’re Here to Help: Securing Your Remote Workforce”

Opportunists pushing the sales of masks, hand sanitizer and other essentials are circumventing an advertising ban on Instagram to capitalize on fears spurred by the novel coronavirus.

Cybercriminals aren’t the only ones capitalizing on global dread related to COVID-19. The pandemic has also led to a proliferation of misinformation and scams. And, now we see opportunists of all kinds getting in on the act.

Over the last week, I’ve observed an uptick in fraudulent advertisements on Instagram, the popular social networking app, promoting masks, hand sanitizer and other essential goods low in supply and high in demand. These opportunists are not only capitalizing on the public’s fears around COVID-19 by offering masks and disinfectant products at inflated prices, they are also capitalizing on their goodwill by claiming to donate masks to hospitals in need with every purchase.

Whether or not these products are legitimately delivered to the buyers is uncertain. But, by exploiting demand and selling these products at a steep markup, the opportunists not only stand to make a tidy profit from their efforts, they’re also potentially depriving medical professionals and others on the frontlines from accessing these much-needed supplies. For example, New York’s governor recently revealed that face masks which normally sell for 58 cents each are being offered to the state for $7.50.

Facebook policy banning certain COVID-19 related advertisements

On March 6, Facebook announced it would temporarily ban ads and listings on its marketplace selling medical face masks. The policy change was confirmed by Rob Leathern, head of trust and integrity for Facebook ads and business platform, and Adam Mosseri, head of Instagram.

Update: We’re banning ads and commerce listings selling medical face masks. We’re monitoring COVID19 closely and will make necessary updates to our policies if we see people trying to exploit this public health emergency. We’ll start rolling out this change in the days ahead.

— Rob Leathern (@robleathern) March 7, 2020

Update: We’re banning ads and commerce listings selling medical face masks on Instagram and Facebook. Supplies are short, prices are up, and we’re against people exploiting this public health emergency. We’ll start rolling this out over the next few days. https://t.co/GyPFEHr4qe

— Adam Mosseri (@mosseri) March 7, 2020

On March 19, Leathern announced that ads for other goods including hand sanitizers, disinfecting wipes and test kits are also banned.

In addition to masks, we're now also banning hand sanitizer, surface disinfecting wipes and COVID-19 test kits in ads and commerce listings. This is another step to help protect against inflated prices and predatory behavior we’re seeing (1/2)

— Rob Leathern (@robleathern) March 19, 2020

However, despite the ban, advertisements continue to appear on Facebook and Instagram, some as recently as March 26.

Advertisements in the Instagram Feed and Instagram Stories

I began observing an uptick in activity in my Instagram Feed on Friday, March 20. All of a sudden, every single sponsored post in my Instagram Feed had something to do with masks, whether it be N95 masks, surgical masks or face shields.

Many of the advertisements don’t overtly reference COVID-19 or the novel coronavirus that causes it in their posts. They do, however, talk about protecting oneself from “harmful particles” and how to “stay protected at all times” while referencing N95 masks or harmful viruses and bacteria, implying a connection to COVID-19.

The advertisements weren’t just showing up in my Instagram Feed. I saw many advertisements in my Instagram Stories as well.

I’ve noticed some interesting trends in relation to the advertisements as well as their origins.

Instagram native vs. Facebook advertisers

One common misconception is that an advertiser needs to have an Instagram account to create sponsored posts on Instagram. This isn’t the case. Facebook advertisers can push advertisements to Instagram using Facebook Ads Manager.

I observed a variety of ads, both native to Instagram as well as from Facebook advertisers.

Below is an example of a native advertisement placed by a newly created Instagram page, duamaskcom.

Below is an example of an advertisement placed by a Facebook page named Plengoods.

Clicking the Plengoods name or avatar leads the user to a special page that identifies Plengoods as a Facebook advertiser with the statement, “This Facebook advertiser isn’t on Instagram.” It also provides the viewer with information about how many Facebook followers the page has, which was 48 at the time I conducted this research.

Instagram and Facebook Page created for COVID-19 ad placements

A variety of these accounts were recently created solely for the purpose of promoting COVID-19-related items like surgical masks and N95 masks.

Accounts weren’t only being created on Instagram. Some Facebook pages appear to be newly created as well, such as the GetN95Mask page below, which had 0 Facebook followers when its advertisement was posted to Instagram.

The opportunists have also created pages for made-up individuals, such as an author named Olivia Wright.

Some advertisements provide direct links to websites offering masks for sale, while others use the URL shortener Bitly to shorten the links to their websites. Unfortunately, detailed analytics on these shortened URLs are no longer available publicly, so I was not able to identify how many individuals had visited them.

Many of the images on these advertisements are similar, likely stock photographs or images from other websites selling these types of masks.

I discovered a pair of Instagram accounts using an identical video in their mask advertisement. The only difference is that in the case of the.blue.mango page, they added an overlay featuring the.blue.mango logo.

Compromised pages on Facebook and Instagram

In addition to creating new pages, opportunists have also compromised the accounts of existing pages and used them to promote these products.

The Facebook Page for a Greek restaurant in Zimbabwe was compromised and used to push an advertisement for surgical masks to Instagram. The page does not appear to have been maintained since 2008.

A page belonging to Asalud Colombia, a Columbian health association, appears to have been hacked as well, as it was used to push an advertisement for surgical masks. It is unclear if the Instagram account itself was hacked, or if it was linked to a compromised Facebook page.

The “Learn More” link in the advertisement does not direct users to the Colombian Health Association website (asaludpp.com), directing them instead to a product page on tuieshop.com.

An Instagram page for Youth Beauty Hair, youthbeautyboutique, appears to have been hacked and used to promote “FDA approved medical-grade masks” in an advertisement. Their page included the post as part of their feed.

The advertisement references a website, emergensupply.com, which was registered on March 9, 2020. Because the ad drives traffic to a newly developed website, instead of to the Youth Beauty Hair website, this leads me to believe their Instagram account was compromised and the opportunists are driving users to a different website.

A Twitter user named “suhopremacist_” tweeted a screenshot of an advertisement from smglobalshop, the official merchandise shop for SM Entertainment, South Korea's largest entertainment company. The page boasts over 235,000 followers.

After further digging, I found that a listing was created on the SM Global Shop website for KN95 masks. However, this page was removed from the website. It is unclear how SM Global Shop’s Instagram page was compromised to host the advertisement while also creating an actual product page on their website. The removal of the product page suggests that opportunists managed to breach their website as well.

Claims of mask donations to a hospital in need

I encountered an account called gridironagency. The page created an advertisement cautioning followers to practice social distancing. It went on to say that the agency was allegedly partnering with “GDMD” to donate masks to “New York Sloan Kettering Hospital.” The post claims that for every mask purchased from the GDMD website, they would donate two “surgical mask” [sic] to the hospital. A few red flags are present. The first is that they did not use the correct name for the facility. It’s actually the Memorial Sloan Kettering Cancer Center. The second is that their advertisement isn’t promoting surgical masks; it is promoting N95 masks instead.

Their page also features an image of a tweet of a BuzzFeed News article that mentions that Memorial Sloan Kettering Cancer Center in New York was running low on masks. Their website, gridironmd.com, was registered on March 16, 2020, making it highly suspect that this agency would actually be partnering and donating these masks. However, it is unclear if the page was hacked or if the page operators merely pivoted toward capitalizing on the interest in personal protective equipment (PPE).

Speaking of donations, another page called seektrendy has also been pushing an advertisement for masks on Instagram. Their page has historically been used to sell products like bunion correctors and more. They just recently started promoting masks. Their advertisement features a video with content taken from news clippings, referencing “coronavirus” and the growing fear of a “global pandemic.” The rest of the advertisement features details about how viruses spread and showcases how these masks protect people. The source of this video content is unclear.

Unlike gridironagency, seektrendy received comments from visitors who came across their advertisements on Instagram, asking them why they aren’t donating to hospitals that desperately need these masks. The administrator for the seektrendy page responded to these comments saying that they’ve “donated plenty of masks” while also calling out other organizations to donate other supplies like hand sanitizers, disinfectant sprays, wipes and toilet paper. A person identifying themselves as an ICU nurse made a similar comment, which was met by a response from seektrendy claiming they’ve donated “over 20 thousand mask (sic).” None of these claims made by seektrendy have been independently verified.

The comments on these posts point to one of the most frustrating aspects of these mask advertisements: If these sellers have masks, they should donate them to hospitals and other healthcare facilities that have a critical need for them, rather than selling them to individuals.

COVID-19-related advertisements from unexpected pages

Another noteworthy aspect of these advertisements is some originated from unexpected pages that aren’t specifically associated with medicine or PPE.

One such page, jennysbeautyspot, is not a new Instagram page, according to the Instagram API. Also, the domainjennysbeautyspot.com was registered in July 2019. The website claims to sell beauty-related goods. However, it appears to have also pivoted to selling carbon filter masks.

Visiting their website, there’s a product page for a premium carbon filter mask.

Another page I discovered was for hikari.company, which bills itself as a company offering “simple and elegant jewelry,” according to their Instagram page. However, they are also advertisings masks on their website, including one called the DispoMask.

The company’s website has a section dedicated to masks, where visitors can purchase masks and hand sanitizers.

Advertisements from legitimate ecommerce platform

Interestingly, I was also served advertisements for surgical masks from Wish, a popular ecommerce platform that “facilitates transactions between sellers and buyers.”

At first, I wasn’t sure if these were fraudulent pages claiming to be Wish. However, I was able to verify the advertisements originated from Wish because the Facebook advertising information showed they had nearly 40 million Facebook followers, and the “Shop Now” link directs users to install the Wish application from the App Store.

Opportunists aren’t just peddling masks

While N95 and surgical masks are some of the most visible parts of COVID-19 coverage due to their limited or lack of availability, the opportunists are also targeting other goods that are low in supply and high in demand.

High-demand goods: Hand sanitizer, toilet paper and gloves

It’s no surprise that opportunists have also been pushing advertisements for hand sanitizer, given the high demand for it.

Next to hand sanitizer, toilet paper has become another high-demand item. I encountered multiple advertisements promoting popular toilet paper brands from Facebook advertisers publishing ads to Instagram.

Gloves are another high-demand good that is low in supply, with ads capitalizing on fear about coming into contact with coronavirus via touching surfaces with bare hands.

Obscure items

Beyond the high-demand items, I also encountered multiple obscure items being promoted that are related to COVID-19.

One ad promoted an item called Virus Shut Out, a “VIRUS disinfection card” that supposedly blocks viruses in the air surrounding the wearer. The product page also claims it was tested by Hokkaido Medical Care Center and is 99.8% effective.

The U.S. Environmental Protection Agency (EPA) recently published a news release about this product, cautioning that it had blocked shipments of Virus Shut Out from entering Honolulu and Guam. The EPA has not registered the product, so its “safety and efficacy against viruses have not been evaluated.” The EPA also warns that it will “not tolerate companies selling illegal disinfectants and making false or misleading public health claims during this pandemic crisis.”

I’ve also noticed several advertisements on Instagram touting the use of ultraviolet (UV) light as a form of sanitization against COVID-19.

The World Health Organization (WHO) has answered the question of “Can an ultraviolet disinfection lamp kill the new coronavirus?” on its COVID-19 myth busters page. WHO cautions against using UV “lamps” to sterilize “hands or other areas of skin” due to the potential skin irritation that can occur. However, WHO does not specifically comment on the effectiveness of using UV light against COVID-19.

Shopify platform used to facilitate opportunism

Throughout this investigation, I saw two separate methods by which masks and other goods are being sold. Most of the websites I encountered used Shopify, the popular ecommerce platform. Opportunists created brand-new websites to promote masks because of the scarcity.

In addition, it appears that opportunists have compromised other websites on Shopify and used them to host pages related to products like masks, hand sanitizer and toilet paper.

SM Global Shop is the best example. It is built on Shopify and was promoting KN95 masks for a brief period of time. However, since the page is no longer accessible, it is likely SM Global Shop realized their Shopify account was compromised and removed the fraudulent product page.

Another example is Knife Love, a website touting jewelry, which serves up a product page with conflicting information.

The product name reads “Kitchen Roll Paper Self Adhesive Wall Mount Toilet Paper Holder,” but the image shows toilet paper. Whoever compromised the Knife Love website appears to have copied and pasted content from a paper towel holder product page on another website.

Leveraging “dropshipping” to make a profit

Many of the websites offering COVID-19-related items like masks and hand sanitizers use what’s called dropshipping. In essence, individuals act as middlemen, setting up a website and placing ads for products they don’t actually possess. Instead, when an order is placed, they source the product from a third party, providing the shipping address for their customer, who then receives the product directly from the third party.


Image Source: Shopify Dropshipping Guide

Many of these advertisers appear to use dropshipping to sell a variety of masks sourced from websites like AliExpress, an online retailing service owned by Alibaba Group.

Some of the masks shown earlier can be purchased for cheap from AliExpress. For example, the “Anti Dust” mask shows a price of $0.32 with a shipping charge of $0.82.

Earlier in this post, we looked at an ad for a mask from an unexpected Instagram page, jennysbeautyspot. The mask was being sold for $20 on the jennysbeautyspot Shopify page. By using dropshipping, the opportunist is making a profit of $18. The estimated delivery for the product is between 30 to 50 days, so some users may actually receive the product weeks after they purchased it. However, there may be some instances where they never actually receive the product at all.

Reporting mask, hand sanitizer and essential good ads to Instagram

Instagram allows users to report these advertisements from within the ads themselves. Click the three dots on the bottom (Instagram Stories) or top (Instagram Feed) of the advertisement. Click “Report Ad” and then select “It’s a scam or it’s misleading.”


Report an ad in Instagram Stories


Report an ad in Instagram Feed

COVID-19 and the growing landscape of threats, misinformation and opportunism

Over the last few months, COVID-19 has been top of mind for most of the world, enabling opportunistic individuals to capitalize on fears and uncertainties. Whether it’s cybercriminals, scammers or those seeking to make a profit from the scarcity of essential goods, COVID-19 has proven to be a successful tool and it will continue to serve as one until the end of the pandemic. That’s why it is important for individuals to seek out information from credible sources, be wary of unsubstantiated cures, refrain from buying masks and purchase essential products from verified sellers or retailers. What we’ve seen so far from these opportunists is just the tip of the iceberg. Unfortunately, I anticipate many more campaigns to come.

As organizations rapidly move to a remote-work model in response to COVID-19, cybersecurity professionals are facing a sudden expansion of the attack surface. Here’s what you need to consider from a vulnerability management standpoint to keep your organization safe.

As organizations of all sizes respond to the COVID-19 pandemic by enabling vast numbers of employees to work from home, cybersecurity leaders are facing a sudden expansion of the attack surface. In addition to helping employees avoid falling prey to the plethora of coronavirus-related malware campaigns and scams currently circulating, organizations would do well to closely monitor the tools being used to enable a suddenly remote workforce. This post is intended to provide guidance for security teams, sysadmins and end users alike about the VPNs, SMTP servers, Windows Remote Desktop Protocols, browsers and routers working overtime to keep organizations up and running.

Understanding the distributed attack surface

As organizations move to a remote-work model, either temporarily for emergency conditions or as a more permanent solution to facilitate talent acquisition and corporate growth, their attack surface also grows. Managing a remote workforce can be challenging, as it distributes the attack surface. This is especially challenging when the distribution is done on short notice, but it’s not an impossible task. CISOs and systems administrators need to focus not only on corporate-controlled assets, but the additional risk brought on by employees’ personal devices that aren’t managed and secured by corporate security measures.

Managing VPNs and mail servers

Remote employees need to connect to corporate resources to collaborate and manage their work. Vulnerabilities found in VPNs, like the Fortinet and Pulse Secure flaws that were actively exploited in summer 2019, or the critical vulnerability in Citrix Application Delivery Controller that was exploited in January of this year, provide a popular target for attackers looking to pivot from the virtual front door to the rest of an organization’s assets.

A higher volume of critical information is being sent through email as employees are being sent the resources they need to work remotely. If an attacker were to gain access to those email servers for a short time, they would have a higher chance of intercepting sensitive data. Simple Mail Transfer Protocol (SMTP) server vulnerabilities – like CVE-2020-0688 in Microsoft Exchange Server and Exim vulnerabilities CVE-2018-6789, CVE-2019-10149, CVE-2019-15846 and CVE-2019-16928– are prime targets for attackers looking to quickly capitalize on unpatched mail servers. So, make sure mail servers are patched and up-to-date, and caution users about the risks of using email to send sensitive data.

The remote environment: Windows Remote Desktop Protocol, web browsers and home networks

Another popular method for employees to connect to a company remotely is via the Windows Remote Desktop Protocol (RDP), which allows them to access a “remote desktop” within their company’s network. Over the years, many vulnerabilities have been identified in RDP, most notably BlueKeep, an unauthenticated remote code execution flaw requiring no user interaction to exploit and spread, similar to EternalBlue. BlueKeep was patched in Microsoft’s May 2019 Patch Tuesday and actively exploited in the wild in late 2019.

While connecting to work remotely comes with its own set of security issues, the applications installed on these devices are not without their own flaws. One of the most common targets are web browsers. Some of the most popular browsers were found to contain vulnerabilities exploited in the wild by attackers as recently as the start of 2020. Vulnerabilities in both Internet Explorer and Google Chrome were actively exploited in January, followed by Mozilla Firefox in late February. These attacks highlight the importance of ensuring the browsers your company uses are always up-to-date with the latest security patches.

The location from which you connect to your company’s network is just as important. Organizations often advise against connecting to public and untrusted Wi-Fi networks with good reasons. When using your home network, if possible, implement LAN and/or Wi-Fi network segmentation, so work devices are not accessible by other devices. Always ensure your modem and router firmware are up-to-date with the latest secure version to ensure these devices are patched against vendor-specific flaws, vulnerable protocols or services, such as the recently disclosed Point-to-Point Protocol Daemon vulnerability.

Conclusion

Managing risks with a distributed workforce can be tricky, and threat actors will continue to be a constant challenge for organizations with remote workers. From remote connections over a corporate VPN to the added risk of employees at home, there’s a lot of ground to cover. Staying informed about your organization’s threat landscape can help you stay ahead of emergent threats and cyber risks. A list of Tenable plugins to identify the vulnerabilities highlighted in this blog post is available here. For guidance on specific vulnerabilities, reference the linked articles below.

Get more information

Scams and malware:

• COVID-19: Coronavirus Fears Seized by Cybercriminals
• COVID-19: Novel Coronavirus Becomes Hotbed for Misinformation, Scams and Fake Cures

Corporate asset risk and remote access:

• CVE-2019-11510: Proof of Concept Available for Arbitrary File Disclosure in Pulse Connect Secure
• CVE-2018-13379, CVE-2019-11510: FortiGate and Pulse Connect Secure Vulnerabilities Exploited In the Wild
• CVE-2019-19781: Exploit Scripts for Remote Code Execution Vulnerability in Citrix ADC and Gateway Available
• CVE-2020-0688: Microsoft Exchange Server Static Key Flaw Could Lead to Remote Code Execution
• WannaCry 2.0: Detect and Patch EternalRocks Vulnerabilities Now
• Exim Buffer Overflow RCE Vulnerability (CVE-2018-6789) – What You Need to Know
• CVE-2019-10149: Critical Remote Command Execution Vulnerability Discovered In Exim
• CVE-2019-15846: Unauthenticated Remote Command Execution Flaw Disclosed for Exim
• CVE-2019-16928: Critical Buffer Overflow Flaw in Exim is Remotely Exploitable

The remote environment:

• Critical 'BlueKeep' Vulnerability CVE-2019-0708 Addressed in Patch Tuesday Updates
• CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner
• CVE-2020-0674: Internet Explorer Remote Code Execution Vulnerability Exploited in the Wild
• CVE-2020-6418: Google Chrome Type Confusion Vulnerability Exploited in the Wild
• CVE-2019-17026: Zero-Day Vulnerability in Mozilla Firefox Exploited in Targeted Attacks
• CVE-2020-8597: Buffer Overflow Vulnerability in Point-to-Point Protocol Daemon (pppd)

Join Tenable's Security Response Team on the Tenable Community.

Over the last few days, a slew of people have texted or called me for practical guidance on how to secure a global, work-from-home organization. So, I crafted this short-ish blog post, mostly as a public service announcement. It’s not intended to be exhaustive.

Secure cloud-based applications

Every decision and technology investment you make will have long-term implications for your organization’s security. If you haven’t already done so, lock arms with IT to secure your software-as-a-service (SaaS) applications via cloud access security brokers for configuration, security and data loss prevention. While you’re at it, integrate all your SaaS solutions into one central identity and access management solution. You’ll save yourself a lot of time and headaches in the long run.

Restrict access to infrastructure-as-a-service providers

At the same time, you should begin working with product engineering to reduce access to infrastructure-as-a-service providers. At Tenable, we set up privileged access management for products like Tenable.io to restrict access to critical systems and data. Use jump boxes, which will give you the ability to access and manage devices in a separate security zone, to reach your critical systems. That way, you limit access to a defined path and reduce your risk.

Add IT systems management onto laptops

Make sure your laptops are fully configured with endpoint protection and detection. Far too many people, including the most tech-savvy, ignore system updates and patches. You can mitigate your risk by adding IT systems management onto your laptops, so that you and your team control software updates and patching. It’s a pretty basic, but super effective step.

Use local vulnerability detection agents

Most people these days have a variety of connected devices – TVs, doorbells, baby monitors, etc. – in their homes, not to mention multiple personal laptops and tablets. Every time they log into their laptop or tablet, each of those devices becomes part of your enterprise attack surface. Since you likely won't be able to run network vulnerability scans, ensure you have local vulnerability detection agents like Nessus installed to provide off-network visibility. At Tenable, most of my colleagues don’t need virtual private network (VPN) access. But VPNs can be a viable option if used properly.

Make sure business continuity plans have critical details

I think it goes without saying, but every organization should build business continuity plans. Start with a business impact analysis (prioritizing the order of operations for people, assets, processes, etc.). Consider financial and operational impacts, along with management tolerances and resource dependencies. Document where your critical data resides and your high-risk users (e.g., executives, those with administrative privileges, those developing source code) and maintain an accurate inventory of their devices. You’ll also need a crisis management plan to communicate across the workforce quickly and effectively.

We’re here for you

We built Tenable from the ground up to empower a remote and agile workforce. We know what system and network traffic patterns look like when most people are working from home – not everyone will have this experience. We understand what patterns to investigate. Our people have the tools they need to work securely and efficiently from anywhere in the world. We’re happy to share what we’ve learned along the way.

For utilities and manufacturers tasked with keeping their lights on during the COVID-19 response, scaled-down workforces can pose increased security risks. Here's how to protect your teams and operations from internal and external threats.

No matter where in the world you are, the last several weeks have likely drastically altered the norms of daily life. With the COVID-19 pandemic rapidly circumnavigating the globe, nearly every business is changing the way they operate to adapt to a new normal. Wherever possible, many employees have been directed to work from home and utilize laptops, tablets, smartphones and conference bridge services. 

But working from home is not always an option. For industries designated as “critical infrastructure” by local and national governments, a certain level of on-site work is required to keep basic needs like food, water, and energy flowing to their respective communities. These operations – which include food and beverage production, electrical and grid operations, oil and gas, shipping and transportation and water producers, among others – cannot scale down, pause operations, or easily transfer to a work-from-home model.

As this unprecedented public health crisis unfolds, manufacturers and critical infrastructure operators face the unique challenge of maintaining uptime and efficient production, within a fully secured environment. While most industrial operations are largely automated today, these connected systems can also be the Achilles’ heel of the entire operation.

Don’t overlook your OT security blind spots

Operational technology (OT) environments face security risks that left unchecked could take down production or significantly alter a product enough to make it dangerous, even deadly. In some cases, the attack surfaces and number of attack vectors in OT environments have grown exponentially. In fact, at an industry-wide level, the amount and severity of attacks targeting OT networks continue to increase each year. And with the convergence of IT and OT, organizations are now experiencing the phenomenon of attacks that laterally creep between IT and OT. Clearly, there is a need to secure OT networks as we have in IT.

Assess the risks of your scaled-down workforce

On an ordinary day, critical infrastructure organizations maintain a security posture that satisfies their board, regulatory bodies and customers. But, what happens when unforeseen events, such as a global pandemic, disrupt routine operations? With a scaled-down workforce and non-essential employees confined to their homes, there is a greater potential for your security posture to slip simply because fewer people are available to maintain normal operations. This can lead to:

• Erroneous changes: Fewer people at the plant or on the production floor increases the possibility of someone misconfiguring a programmable logic controller (PLC), especially if a junior engineer less familiar with the process makes an inadvertent change.
• Delayed response: Due to short staffing, or the need to divert employees to other tasks, security personnel may be negatively impacted in their ability to react to alarms in a timely fashion.
• Opportunistic attacks: Nefarious activity will likely increase during this period as hackers look to exploit the procedural disruptions and overstretched skeleton crews associated with non-standard business operations.

Taking an honest look at these vulnerabilities is the first step to understanding which security measures need to be in place to keep critical operations running smoothly and safely.

Begin to play offense in your industrial security efforts

Even as the COVID-19 pandemic rapidly changes the playing field, industrial security doesn’t have to suffer. There are steps that utilities and manufacturers can take to protect their operational networks and empower staff to safely continue their work both on-site and from home. Continuity of service depends on a robust and resilient approach to OT security that includes:

• Ensuring full visibility of your IT/OT infrastructure. This includes both the global scope of your distributed network as well as drill-down capabilities into granular device information (e.g. serial number, OS, firmware). Secured-anywhere access to these unified dashboards can empower authorized personnel and remote staff to continue their routine monitoring and security as if they were in their normal office setting.

• Updating your mobile policy and alarm triggers. Notification chains for violations or questionable behaviors should reflect your newly remote and mobilized workforce. This means making sure each alert is finely tuned to reach the right person at the right time via the most relevant medium (such as phone, PC, or text), depending on whether the recipient is working on-site or remotely.

• Maintaining a paper trail of changes to industrial controllers. Configuration control should capture automated “snapshots” any time a PLC programming change occurs, preserving knowledge of the “last known good state” as well as who was on the network, what actions they took, and the subsequent results or interruptions. While malware may alter programming on a PLC, hazardous changes can just as easily come from a careless employee or junior engineer who is overworked, outside their usual role, or distracted due to other priorities.

For many critical industries, the sobering reality of the COVID-19 era is that business must continue, no matter how trying the circumstances.

Our ability to navigate this unscripted departure from normalcy requires deep situational awareness of both the macro and micro levels of operations. Survival will require grit and perseverance, and agile teams and systems that can grow and adapt alongside the organization. In the immortal words of Apollo 13 flight director Gene Kranz, the present situation demands nothing less than “our finest hour.”

By combining the right tools and attitude with the collective will of the security community, we can come through this tribulation stronger and more resilient than ever before.

More information on industrial cybersecurity

For additional ways to upgrade your OT security posture, here are some resources that can help: 

• Watch the on-demand webinar, “5 Things You Need to Know About IT/OT Convergence”
• Check out the infographic on “The 7 Most Unsafe Gaps for Industrial Cybersecurity”
• Review the Industrial Cybersecurity checklist for key criteria to protect critical infrastructure

Facing growing security concerns, Zoom patches multiple vulnerabilities and vows to focus on top safety and privacy issues.

Background

As more companies shift to remote work, their use of tools to support these efforts are coming under greater scrutiny. Zoom, the video conferencing application used by over 200 million users daily, has seen a surge in popularity. However, over the last few months, the security community has reported several privacy and security issues with Zoom, culminating in a series of public disclosures that prompted a response from the Zoom CEO.

Analysis

Zoom-bombing

The increased remote working footprint and reliance on Zoom has led to a wave of mischief makers dropping in uninvited on insecure Zoom meetings to play offensive material, such as pornography, via Zoom’s screen-sharing feature. They’re also verbally insulting and threatening meeting participants using profane or racist language. These acts, dubbed “Zoom-bombing,” have steadily increased over the last few months.

On March 30, the FBI issued a warning after receiving multiple reports of meetings being targeted by Zoom-bombers. The agency provided its own set of mitigations to protect against Zoom-bombing, a page to report teleconference hijacking incidents and another page to report specific threats received during one of these incidents.

The recent surge in Zoom-bombing is reminiscent of CVE-2018-15715, an unauthorized command execution vulnerability discovered by Tenable researcher David Wells in November 2018. Wells detailed how this flaw could be used to hijack screen controls, spoof chat messages or kick attendees out of Zoom calls. However, the latest surge in Zoom-bombing doesn’t appear to use vulnerabilities.

In a blog post from Check Point on January 28, researcher Alexander Chailytko pointed out that unless a Zoom meeting is password-protected or the waiting room feature is enabled, the only information preventing uninvited guests from joining an existing Zoom meeting is knowing the 9- to 11-digit Zoom meeting ID. To highlight this weakness, Chailytko generated a list of potential Zoom meeting IDs and randomly selected a thousand. Four percent of the IDs worked, demonstrating a high rate of success, especially considering they were randomly chosen. Chailytko coordinated his disclosure on July 22, 2019, which resulted in changes being implemented by Zoom.

An article by ZDNet discusses how Zoom-bombers are getting increasingly organized, congregating across multiple online platforms including Discord, Reddit and Twitter to coordinate mass Zoom-bombings and share meeting IDs collected via social media and internet-scraping scripts. Zoom-bombers are not just coming together to randomly invade meetings, but also offering it as a service for people to submit their business or educational meeting codes to intentionally disrupt meetings and online lectures.

The collection of potentially unprotected Zoom meeting IDs and related credentials is trivial for people with basic coding and web-scraping skills. On April 2, investigative journalist Brian Krebs tweeted about a tool that makes the process even easier.

Automated Zoom conference meeting finder 'zWarDial' discovers ~100 meetings per hour that aren't protected by passwords. The tool also has prompted Zoom to investigate whether its password-by-default approach might be malfunctioning https://t.co/dXNq6KUYb3pic.twitter.com/h0vB1Cp9Tb

— briankrebs (@briankrebs) April 2, 2020

The zWarDial tool, created by Trent Lo and other members of SecKC, attempts to bypass measures Zoom has put in place to prevent automated meeting scans by routing its scans through multiple proxies in Tor. The article in Krebs’ tweet notes that a single instance of zWarDial “can find approximately 100 meetings per hour” with a 14-percent success rate. The potential meetings discovered per hour also increases with each subsequent deployment of the tool. SecKC shared a chart showing the roughly 2,400 open Zoom meetings they discovered over a 24-hour period, indexed by industry.

Zoom originally responded to the threat of Zoom-bombing in a blog post on March 20, offering tips on how to configure Zoom’s privacy settings to keep uninvited guests out of meetings.

Zoom Windows client: UNC path injection

On April 1, Zoom announced a fix for a flaw in the Windows client. Previously, the handling of universal naming convention (UNC) links in Zoom chat rooms could have exposed Net-NTLM-v2 hashes to an attacker, who could then utilize tools like hashcat to crack these hashes.

Security researcher _g0dmode first identified the issue on March 23.

#Zoom chat allows you to post links such as \\x.x.x.x\xyz to attempt to capture Net-NTLM hashes if clicked by other users.

— Mitch (@_g0dmode) March 23, 2020

In a tweet, _g0dmode noted that the Zoom client “allows you to post links such as \\x.x.x.x\xyz to attempt to capture Net-NTLM hashes.”

The following week, security researcher Hacker Fantastic demonstrated the UNC path injection in a tweet.

Hi @zoom_us& @NCSC - here is an example of exploiting the Zoom Windows client using UNC path injection to expose credentials for use in SMBRelay attacks. The screen shot below shows an example UNC path link and the credentials being exposed (redacted). pic.twitter.com/gjWXas7TMO

— Hacker Fantastic (@hackerfantastic) March 31, 2020

To take advantage of the flaw, an attacker would need to be in a Zoom session and convince attendees to click a specially crafted link. When a user clicks the link containing the UNC path, Windows attempts to connect to the remote site using the Server Message Block (SMB) protocol. As a default, Windows sends the user’s login name and NTLM password hash, which could potentially be cracked and used by a malicious actor. The successful exploitation of this flaw can be mitigated by following Microsoft’s guidance on restricting outgoing NTLM traffic to remote servers, or by updating Zoom to version 4.6.9 or later.

Zoom macOS installer and client: Local privilege escalation and code injection

In the macOS installer and client, multiple vulnerabilities were identified and disclosed.

The first vulnerability stems from the way Zoom installer utilizes pre-installation scripts to unpack the application. An attacker with local access could abuse these pre-installation scripts to elevate privileges to root by monitoring for the presence of the Zoom installer or updater and modifying one of the scripts during this process.

The second vulnerability is a code injection flaw in Zoom that results from its use of the “disable library validation” entitlement, which allows applications that use Hardened Runtime to load unsigned frameworks, plugins or libraries. An attacker could exploit this vulnerability to access the user’s camera and microphone via this entitlement. This could be achieved by renaming the ‘libssl.1.0.0.dylib’ file under the Zoom frameworks, creating a malicious version that acts as a proxy which references the original library file along with malicious code.

Privacy concerns

Over the past several weeks, Zoom has received scrutiny from the security community concerning the data collection and privacy implications of using the application. On March 26, VICE published a report that revealed Zoom’s iOS application was sending analytics data to Facebook even when Zoom users didn’t have a Facebook account. Zoom confirmed it had implemented the “Login with Facebook” feature using the Facebook software development kit (SDK), which collects device data. In response to the news, Zoom removed the Facebook SDK from its iOS application, promising to review its “process and protocols for implementing these features in the future to ensure this does not happen again.”

The New York Times article published on April 2 highlights another instance of data mining in which Zoom usernames and email addresses were matched to LinkedIn accounts. This feature was implemented using the LinkedIn Sales Navigator, which covertly sent a person’s username and email address to Zoom’s internal systems each time they enter a meeting. Other attendees who subscribed to the LinkedIn service could view information associated with meeting participants, including job titles, employer names and locations, even if the attendees chose not to use their real names. The removal of LinkedIn Sales Navigator was included in Zoom’s public memo on April 1 as part of its renewed focus on privacy issues.

Zoom also faced increased scrutiny around whether or not its service had implemented end-to-end encryption. In a response from Zoom on April 1, the company clarified that encryption is used to “protect content in as many scenarios as possible, and in that spirit, we used the term end-to-end encryption.” Zoom notes that to keep data encrypted in the transmission process, it uses several specialized clients including:

• Zoom Telephony Connector
• Zoom Conference Room Connector
• Skype for Business Connector
• Cloud Recording Connector
• Live Streaming Connector

In a blog post on March 29, Zoom responded to privacy and security concerns, indicating that while the company is not changing its practices, it had updated its privacy policy to be “more clear, explicit, and transparent”

Proof of concept

While no proof-of-concepts (PoCs) exist for the flaws, the blog post detailing the Zoom vulnerabilities in the macOS installer and client contains enough information to develop PoCs.

Vendor response

Zoom CEO Eric Yuan published a blog post on April 1, addressing several of the privacy and security issues that had been raised. He said that over the next 90 days, the company will be doing a feature freeze, shifting their focus toward addressing “trust, safety, and privacy issues.” This includes enhancements to Zoom’s bug bounty program, the creation of a CISO council, penetration testing and weekly webinars to update the community.

Solution

When creating Zoom meeting rooms, do not make them public. When configuring a meeting, opt for Zoom to create a randomly generated ID, rather than checking the personal meeting ID option. Set meetings to private and be sure to require a password.

Also, disable the join before host option to prevent potential trouble before hosts arrive at the meeting, assign a co-host to help moderate the meeting and enable the Waiting Room to view attendees before the meeting commences.

Additional precautions include disabling allow removed participants to rejoin and file transfer.

On April 2, Zoom released version 4.6.9 of its Windows and macOS clients to address several of the flaws reported over the last few weeks.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Zoom CEO’s response to users

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Researchers report multiple zero-day vulnerabilities in Mozilla Firefox and note that other browsers are also affected.

Background

On April 3, Mozilla Foundationpublished advisory 2020-11 for Mozilla Firefox and Mozilla Firefox Extended Support Release (ESR). The advisory includes fixes for two critical zero-day vulnerabilities, both of which were exploited in the wild as part of targeted attacks.

The discovery of these vulnerabilities was credited to security researchers Francisco Alonso and Javier Marcos. Alonso tweeted there are “more details to be published (including other browsers),” indicating these flaws likely extend to other web browsers. However, that information is currently not public, likely an effort to keep the details private until patches are available.

There is still lots of work to do and more details to be published (including other browsers). Stay tuned.

— Francisco Alonso (@revskills) April 3, 2020

As we’ve seen time and again, attackers continue to target widely installed applications such as web browsers. These latest vulnerabilities follow on the heels of another zero-day vulnerability in Mozilla Firefox exploited in the wild in January 2020.

Analysis

CVE-2020-6819 is a use-after-free vulnerability due to a race condition when the nsDocShell destructor is running. Based on the GitHub commit history for the nsDocShell.cpp file, it appears the issue exists due to the mContentViewer not being released properly.

Image source: GitHub of nsDocShell changes made to address CVE-2020-6819

CVE-2020-6820 is a use-after-free vulnerability due to a race condition in the ReadableStream class, which is used to read a stream of data.

Image source: MDN web docs

We anticipate further details about these vulnerabilities will be publicly available once the researchers publish their findings.

Proof of concept

At the time this blog post was published, there was no proof-of-concept code available for either of these vulnerabilities.

Solution

Mozilla Foundation released Mozilla Firefox 74.0.1 and Mozilla Firefox ESR 68.6.1 to address these vulnerabilities. While these vulnerabilities were exploited in targeted attacks, Firefox users are still encouraged to upgrade as soon as possible.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Mozilla Foundation Security Advisory 2020-11

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Configuration transparency is the key to dealing with vulnerabilities.

Vulnerabilities are unavoidable. In contemporary IT configurations, attackers have access to a wide range of entry points they can use to gain access to a network. What's more, you can't control all the attack vectors they may use to target you. 

To combat these vulnerabilities, you need a deep understanding of what is happening on your systems at any given time. This requires a holistic blend of network monitoring and vulnerability scanning to ensure you have constant visibility into your vulnerability landscape.

The scope of vulnerability challenges

The wide variety of cybersecurity threats facing businesses today is well established. With new vulnerabilities in cybersecurity emerging on a regular basis, organizations must have their vulnerability scanning capabilities up to speed to keep pace with varied attack types. Some of these include:

• Increased sophistication in ransomware attacks
• Heightened targeting of containers
• More ambitious, large-scale DDoS attacks alongside an increased volume of small attacks targeting a wider range of businesses
• The emergence of cloudjacking (hackers compromising cloud administrator accounts to make unauthorized purchases)

These are just a few examples of emerging attack vectors that companies must think about. But Tenable Research shows that many businesses are still playing catch-up. After analyzing more than 200,000 vulnerability assessment scans, they found that time is on the side of the cyberattackers:

• The average window in which a network flaw can be exploited is approximately 7.3 days, meaning attackers often have a full week to exploit a specific weakness before businesses have assessed for and addressed it.
• In cases when vulnerabilities were disclosed publicly (e.g., software flaws that needed patching), 34% of the flaws had an exploit available the same day they were disclosed.
• Approximately one-quarter of the vulnerabilities analyzed were actively exploited by malware, ransomware or other attack tools.

Businesses must think broadly about dealing with security vulnerabilities. Cyber threats are highly varied, and common vulnerabilities often slip through the cracks as IT teams struggle to keep up with everyday operational demands. To more efficiently deal with the information security issues facing your business, here are a couple key tips you can follow to keep up with the threats:

1. Run regular penetration and vulnerability tests

A penetration test analyzes your configuration, identifying exploitable weak points. Vulnerability assessments handle a similar function, focusing on weaknesses in applications and software. Running both of these tests on a consistent schedule provides ongoing visibility into your weak points, letting you identify bugs quickly and take action to resolve vulnerabilities before they escalate.

2. Take a comprehensive approach

Some businesses attempt to deal with threats from varied attack vectors by deploying “divers” – segregated tools that are cumbersome to manage and maintain. Simple data quality issues often undermine strategies to gain IT transparency. Instead, use a vulnerability assessment solution that covers all bases and scans all aspects of your attack surface.

The ideal tool should provide complete visibility into IT configurations and enable you to get a full picture of your network. 

The Nessus vulnerability scanner provides comprehensive vulnerability assessment capabilities to help businesses:

• Gain greater visibility into assets across system types within the configuration
• Automate vulnerability assessments, measure risk associated with an exploit and analyze the importance of remediation
• Provide complete, real-time visibility needed to identify vulnerabilities quickly

See how our solutions can help you manage vulnerabilities and reduce your cyber risk.

Try Nessus Free for 7 Days

VMware patches a critical information disclosure flaw in vCenter Server with a CVSSv3 score of 10.0.

Background

On April 9, VMware published VMSA-2020-0006, a security advisory for a critical vulnerability in vCenter Server that received the maximum CVSSv3 score of 10.0.

Analysis

CVE-2020-3952 is a sensitive information disclosure flaw in VMware vCenter Server. The flaw resides in the VMware Directory Service (vmdir), which is included in vCenter Server as part of an embedded or external Platform Services Controller (PSC). Under “certain conditions,” vmdir does not implement proper access controls, which could allow a malicious attacker with network access to obtain sensitive information. While the advisory does not indicate what sensitive information could be obtained, VMware notes this information could be used to compromise vCenter Server or other services that use vmdir for authentication.

Proof of concept

At the time of this writing, no public PoC has been released for this vulnerability. Based on the CVSSv3 score of 10.0 assigned to this vulnerability, it is likely that it may be easy to exploit.

Solution

VMware released vCenter Server version 6.7u3f to address this vulnerability. The following table lists the affected versions of vCenter Server.

According to VMware’s advisory, the vulnerability only affects specific versions of vCenter Server versions 6.7. Specifically, those instances where vCenter Server was upgraded from a previous version, including version 6.0 or 6.5. A new and clean installation of vCenter Server 6.7 is not affected.

VMware has published KB article 78543 with additional guidance to determine if a vCenter Server 6.7 deployment is affected.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• VMware VMSA-2020-0006 Security Advisory
• VMware KB 78543: Additional Documentation for VMSA-2020-0006

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

As uncertain times lead to a shift in how we work, identifying, prioritizing and addressing critical flaws that have been exploited in the wild is paramount.

We recently shared some insights into how the worldwide response to COVID-19 has expanded the attack surface for businesses. These insights, shaped by our own research and open-source intelligence, provide a glimpse into some of the key areas organizations need to address given the dynamics of a changing workforce.

With tens of thousands of vulnerabilities being discovered each year, honing in on the highest-risk issues is key.

The state of CVSS

The Common Vulnerability Scoring System (CVSS) is an industry-standard system used to provide valuable insight into the scope and severity of vulnerabilities. CVSS scores are typically defined at the time they were generated for a CVE. However, they don’t always account for changes to the impact of a vulnerability until much later.

For example, a vulnerability in the Pulse Connect Secure Secure Socket Layer (SSL) Virtual Private Network (VPN), identified as CVE-2019-11510, was originally assigned a CVSS score of 8.8 on May 9, 2019, resulting in the flaw being categorized as a high-severity vulnerability. However, despite the availability of a proof of concept for the vulnerability on August 21, 2019, the CVSS score was not updated to reflect the critical nature of the flaw until a month later on September 20, 2019.

Similarly, a vulnerability in the FortiGuard SSL VPN, identified as CVE-2018-13379, initially received a CVSS score of 7.5 on June 5, 2019. However, its CVSS score was not updated until September 19, 2019, one month after research about the flaw became publicly available on August 9 as well as the external attempts to identify the vulnerability in the wild along with CVE-2019-11510 on August 22.

CVSS scores are a useful indicator of a vulnerability’s severity and should not be disregarded, but relying solely upon them to prioritize vulnerabilities for remediation can at times be problematic.

Prioritize patching these vulnerabilities

Through Tenable’s Predictive Prioritization, vulnerabilities are given a Vulnerability Priority Rating (VPR) that not only factors in CVSS, but also leverages a machine learning algorithm coupled with threat intelligence to prioritize vulnerabilities. To aid in protecting the expanding attack surface, we are providing the following list of the vulnerabilities our team and the data science team have identified as the most critical for organizations to patch along with their VPR.

Facilitating remote work

SSL VPN software like Pulse Connect Secure, FortiGate, GlobalProtect and Citrix Application Delivery Controller and Gateway is used by organizations to provide secure access to a company’s network. Several vulnerabilities have been discovered in these applications and they’ve been exploited in the wild by threat actors. Therefore, it is increasingly important that organizations using any of these SSL VPNs ensure they’ve been appropriately patched.

Additionally, Remote Desktop Services enables individuals to virtually connect to machines within the company’s environment as if they were physically present in front of the system. CVE-2019-0708, a remote code execution vulnerability in Remote Desktop Services, dubbed “BlueKeep,” is another flaw that received considerable attention because of its potential to facilitate the next “WannaCry” attacks. While such attacks never came to fruition, reports did emerge that it had been exploited in the wild several months later. However, Remote Desktop in and of itself is an area organizations should be routinely monitoring for exploitation attempts as well as identifying exposed RDP targets.

*Please note Tenable VPR scores are calculated nightly. This blog post was published on April 13 and reflects VPR at that time.

Vulnerabilities used in malicious emails and exploit kits

As cybercriminals seized on COVID-19 fears, one of the most popular vulnerabilities leveraged in malicious documents is CVE-2017-11882, a stack overflow vulnerability in the Equation Editor component of Microsoft Office. It has been a fixture in malicious email campaigns for years, and will remain one of the common tools in the toolbox for threat actors.

Another tool in the threat actor arsenal is the use of exploit kits, software designed by cybercriminals to fingerprint the presence of popular software applications on a victim's machine and select the most appropriate vulnerability to exploit. While vulnerabilities in Adobe Flash Player, such as CVE-2018-15982 and CVE-2018-4878, have been a staple in several exploit kits, the pending end-of-life for Adobe Flash Player coupled with the shift toward HTML5 has forced some exploit kits to drop Flash Player vulnerabilities entirely and search for other vulnerabilities to utilize instead. CVE-2018-8174, a use-after-free vulnerability in the VBScript Engine, dubbed “Double Kill” by researchers because it corrupts two memory objects, is one such vulnerability that has become favored in exploit kits.

*Please note Tenable VPR scores are calculated nightly. This blog post was published on April 13 and reflects VPR scores at that time.

Other vulnerabilities exploited in the wild

For organizations using certain versions of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software, it is important to patch CVE-2018-0296, a denial-of-service flaw in the web interface of these devices, causing unexpected reloads. Cisco cautions that certain vulnerable versions of ASA won’t reload, but an unauthenticated attacker could view sensitive system information on the device. At the end of 2019, reports emerged that exploitation attempts for this vulnerability had spiked.

Additionally, CVE-2019-0604, an improper input validation vulnerability in Microsoft SharePoint, the popular collaboration platform used for document storage and management, has been exploited in the wild since May 2019. Initially, this flaw was given a CVSSv3 score of 7.8. It was revised in June 2019 to an 8.8, and updated again in December 2019 to 9.8. If your organization uses Microsoft SharePoint, it is critical that this flaw gets patched.

*Please note Tenable VPR scores are calculated nightly. This blog post was published on April 13 and reflects VPR scores at that time.

Navigating through a sea of uncertainty

With all the changes to how we work during these uncertain times, organizations need to understand how the attack surface shifts and how best to respond. Knowledge is power, both in understanding your risk by knowing what assets you have in your environment, but also the insights to make risk-based decisions. Implementing a risk-based vulnerability management program within your organization can help you navigate through these uncharted waters.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities can be found here.

Get more information

• How COVID-19 Response Is Expanding the Cyberattack Surface

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Microsoft's April 2020 Patch Tuesday includes 113 CVEs, including a patch for two zero-day flaws (CVE-2020-0938 and CVE-2020-1020) in Adobe Type Manager Library disclosed on March 23.

Microsoft addressed 113 CVEs in the April 2020 Patch Tuesday release, marking the second month in a row that Microsoft has patched over 100 CVEs; the March 2020 Patch Tuesday contained fixes for 115 CVEs. Of the 113 CVEs, 19 were rated as critical, four were exploited in the wild and two had already been publicly disclosed. This update contains patches for 39 remote code execution flaws as well as 38 elevation of privilege vulnerabilities, including fixes for Microsoft Windows, Microsoft Edge, Microsoft Office, Internet Explorer, ChakraCore, Windows Defender, Visual Studio, Microsoft Office Services and Web Apps and Microsoft Dynamics. The following is a breakdown of the most important CVEs from this month’s release.

CVE-2020-1020 and CVE-2020-0938 | Adobe Type Manager Library Remote Code Execution Vulnerabilities

CVE-2020-0938 and CVE-2020-1020 are vulnerabilities in the way that Windows parses OpenType fonts. Successful exploitation would require an attacker to convince a victim to open a malicious document or visit a malicious page that exploits the WebClient service, which is normally listening for WebDAV file shares. Due to public exploitation of these vulnerabilities on Windows 7 systems, Microsoft issued an advisory, ADV200006 on March 23. Get more information in our blog post.

CVE-2020-0687 and CVE-2020-0907 | Microsoft Graphics Remote Code Execution Vulnerabilities

CVE-2020-0687 and CVE-2020-0907 are both remote code execution vulnerabilities in Microsoft Graphics and Microsoft Graphics Components, which could allow an attacker to take control of a system and execute arbitrary code. CVE-2020-0687 is the result of the Windows font library improperly handling specially crafted embedded fonts. CVE-2020-0907 exists due to how Microsoft Graphics Components handles objects in memory. In each of these cases, an attacker would need to convince a victim to either open a specially crafted file or visit a specially crafted webpage. Microsoft gives these CVEs a rating of ‘exploitation less likely’ due to the user interaction required to successfully exploit these flaws.

CVE-2020-0935 | OneDrive for Windows Elevation of Privilege Vulnerability

CVE-2020-0935 is an elevation of privilege vulnerability in OneDrive for Windows due to the desktop application improperly handling symbolic links. An attacker who logs on to the system could execute a specially crafted application to exploit this vulnerability to overwrite a targeted file. This vulnerability has been publicly disclosed and Microsoft’s advisory notes that most customers are protected because OneDrive has its own updater. However, customers who have an air-gapped network will need to update the OneDrive binary from Microsoft to be protected.

CVE-2020-0968 | Scripting Engine Memory Corruption Vulnerability

CVE-2020-0968 is a memory corruption vulnerability in Internet Explorer due to the improper handling of objects in memory by the scripting engine. According to Microsoft, this vulnerability has been exploited in the wild. There are multiple scenarios in which this vulnerability could be exploited. An attacker could convince a victim to visit a website containing malicious code, whether or not that website is owned by the attacker, or a compromised website with malicious code injected into it. Another scenario would require the attacker to embed the malicious code into a Microsoft Office document and convince the victim to open it.

CVE-2020-0948, CVE-2020-0949 and CVE-2020-0950 | Media Foundation Memory Corruption Vulnerabilities

CVE-2020-0948, CVE-2020-0949 and CVE-2020-0950 are memory corruption vulnerabilities that exist when Windows Media Foundation improperly handles objects in memory. Successful exploitation of this vulnerability could allow the installation of programs, the reading, alteration or deletion of data or the creation of new accounts with full user rights. To exploit these vulnerabilities, an attacker would need to convince a victim to open a specially crafted file or visit a malicious website.

CVE-2020-0953, CVE-2020-0988, CVE-2020-1008, CVE-2020-0995, CVE-2020-0994, CVE-2020-0992, CVE-2020-0999, CVE-2020-0889, CVE-2020-0959 and CVE-2020-0960 | Jet Database Engine Remote Code Execution Vulnerabilities

CVE-2020-0953, CVE-2020-0988, CVE-2020-1008, CVE-2020-0995, CVE-2020-0994, CVE-2020-0992, CVE-2020-0999, CVE-2020-0889, CVE-2020-0959 and CVE-2020-0960 are remote code execution vulnerabilities that exist when the Windows Jet Database Engine improperly handles objects in memory. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on a vulnerable system. To exploit them, an attacker would need to convince a victim to open a specially crafted file.

CVE-2020-0910 | Windows Hyper-V Remote Code Execution Vulnerability

CVE-2020-0910 is a remote code execution vulnerability that exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. Exploitation of this vulnerability allows an attack on a guest operating system to execute a crafted application that could cause the Hyper-V host operating system to execute arbitrary code. While this vulnerability could be mitigated by restricted rights by access controls, CVE-2020-0917 and CVE-2020-0918, a pair of privilege escalation vulnerabilities in Windows Hyper-V, could be used to gain elevated privileges on a target operating system due to the way in which Windows Hyper-V handles objects in memory.

CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0971 and CVE-2020-0974 | Microsoft SharePoint Remote Code Execution Vulnerabilities

CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0971 and CVE-2020-0974 are remote code execution vulnerabilities that exist in Microsoft SharePoint when the software fails to check the source markup of an application package. Successful exploitation of these vulnerabilities could allow an attacker to run arbitrary code with the permissions of the SharePoint application pool and SharePoint server farm account. To exploit them, an attacker, with administrator privileges, would need to upload a specially crafted SharePoint application package to a vulnerable version of SharePoint.

CVE-2020-1022 | Dynamics Business Central Remote Code Execution Vulnerability

CVE-2020-1022 is a remote code execution vulnerability in Microsoft Dynamics Business Central. To exploit the vulnerability, an authenticated attacker would need to convince a victim to connect to a malicious client. Exploitation of this vulnerability could allow an attacker to execute shell commands on the vulnerable Dynamics Business Central server.

CVE-2020-0913, CVE-2020-1000, CVE-2020-1003 and CVE-2020-1027 | Windows Kernel Elevation of Privilege Vulnerabilities

CVE-2020-0913, CVE-2020-1000, CVE-2020-1003 and CVE-2020-1027 are elevation of privilege flaws due to the Windows kernel failing to properly handle objects in memory. CVE-2020-0913, CVE-2020-1000 and CVE-2020-1003 can be exploited to execute arbitrary code in kernel mode, but would require an attacker to first log on to the system. CVE-2020-1027 could allow a locally authenticated user to execute code with elevated privileges. This vulnerability was reported to Microsoft by Google Project Zero, after it was discovered being exploited in the wild.

We discovered CVE-2020-1027 being exploited in the wild and reported it on 23 March under a 7-day deadline (used only for actively exploited bugs). Microsoft asked for an extension due to current global circumstances and we agreed. Patch details at https://t.co/VF3SqXHYV9 (1/2)

— Tim Willis (@itswillis) April 14, 2020

Tenable solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains April 2020.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s April 2020 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

• Microsoft's April 2020 Security Updates
• Tenable plugins for Microsoft April 2020 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.