Cisco releases a bundled publication to address 12 vulnerabilities across Adaptive Security Appliance (ASA), Firepower Threat Defense (FTD) and Firepower Management Center (FMC), including a critical path traversal vulnerability.

Background

On May 6, Cisco released security advisories for 34 vulnerabilities, including 12 vulnerabilities rated as “High,” in its Adaptive Security Appliance (ASA), Firepower Threat Defense (FTD) and Firepower Management Center (FMC) as part of a bundled publication.

Analysis

The 12 vulnerabilities in the bundled publication include the following:

While the majority of the vulnerabilities in this publication are denial of service, the path traversal vulnerability appears to be the most notable, with a CVSSv3 score of 9.1.

CVE-2020-3187 is a path traversal vulnerability that surfaces in the web services of Cisco’s Adaptive Security Appliance and Firepower Threat Defense software when the WebVPN or AnyConnect feature is configured. According to Cisco, this flaw exists when processing URLs that are not properly validated. A remote, unauthenticated attacker could send a specially crafted HTTP request using “directory traversal character sequences” to the affected device, allowing the attacker to read or delete sensitive files from the web services file system. The advisory from Cisco notes that any ASA or FTD device with a vulnerable AnyConnect or WebVPN configuration is affected. The following tables show the ASA or FTD feature and the associated vulnerable configuration displayed when using the 'show running-config' command via the command-line interface:

Source:Cisco CVE-2020-3187 Advisory

Source:Cisco CVE-2020-3187 Advisory

Reading sensitive files is limited in scope

This vulnerability evokes memories of recent vulnerabilities in SSL VPNs like Pulse Connect Secure, FortiGate, and Citrix ADC. While they might seem similar in nature, it does not appear that this vulnerability has the same level of exposure. According to Cisco’s advisory, an attacker can only read and delete files “within the web services file system” and the exposure “does not apply to the ASA and FTD system files or underlying operating system (OS) files.” The type of files exposed in the web services file system include:

• WebVPN configuration
• Bookmarks
• Web cookies
• Partial web content
• HTTP URLs

Deleted files are recoverable

Cisco’s advisory also notes that, even if an attacker were to delete files from the web services file system, the files would be restored once the device has been reloaded.

Proof of concept

At the time this blog post was published, there were no proofs-of-concept available for any of the advisories Cisco released.

Solution

Cisco has released software fixes for most of these vulnerabilities. However, not all of the advisories appear to have released complete fixes. We recommend referring to the individual Cisco advisories or contacting the Cisco Technical Assistance Center (TAC) for information on solutions.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Cisco Advisories for May 6, 2020
• Cisco May 2020 ASA, FMC, and FTD Software Security Advisory Bundled Publication

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

This is the second installment in our three-part series exploring how to use Tenable products to protect credentials used for network assessments. Here, we provide specific guidance for Microsoft Windows systems.

In my last post, I covered general best practices for protecting credentials when performing network assessments. When it comes to protecting credentials in a Microsoft Windows Active Directory environment, though, we have specific guidance.

Please note that enabling some of these controls may affect other parts of your network and systems. Before you implement any of these changes, you should test all settings thoroughly to determine if they are appropriate for your environment. Not all organizations will be able to implement all these settings. When configuring service account(s) for use in credentialed scanning, below are some key considerations unique to Windows hosts.

5 tips for credentialed scanning of Windows hosts:

1. Disable interactive log on.
   Usually, accounts used for remote administrative authentication, like Nessus performs, don’t need to behave like a standard user account. To this end, enabling functionality that prevents unnecessary access like “Deny log on locally” or “Deny log on through Remote Desktop Services” is a good idea. 
2. Restrict delegated access.
   Like interactive logon, Microsoft allows account privileges to be delegated under certain circumstances to enable specific functionality. This is not necessary for vulnerability scanning and should be disabled.
   
3. Add the account to the “Protected Users” group.
   If your Active Directory (AD) domain supports it, the “Protected Users” group adds additional security to how credentials are treated when authenticating to a host. The controls provided to this group are especially important if you can’t take advantage of all the other suggestions listed here. If your domain doesn’t support this functionality yet, try to implement the controls it provides individually where possible.
4. Secure SMB protocols.
   It seems every few years, there’s a new critical vulnerability in the SMB protocol or the network services that live behind it. While keeping up-to-date on patches is critical, you can make several proactive configuration changes to further secure this service:
   • Disable SMBv1
   • Enforce SMB signing
   • Enable SMB encryption
     
     
5. Prioritize or force Kerberos authentication.
   Kerberos is the authentication protocol of choice for modern Windows systems. It has several benefits over NTLM, including preventing relay attacks, and is relatively easy to implement. By default, Nessus will disable the use of insecure protocols like NTLMv1 and LM. 

Things to avoid:

• Do not use Domain Admin accounts (and other “High” privileged accounts).
  Accounts in the “Domain Admin” group are extremely powerful and should be tightly controlled and restricted. Nessus does not require Domain Admin level privilege (or any domain-wide privilege) for remote network scanning, it only requires administrative access to the local machine being assessed.

• Do not use domains as security boundaries.
  In AD, different domains that are part of one forest are not segmented. A compromise in one almost always means the entire forest is compromised. Segregating your privileged accounts and systems into another forest is essential. If using domain credentials to authenticate, especially if using higher-privileged accounts, ensure they’re part of a separate forest.

• Do not reuse accounts between scanning and users or other IT operations.
  I noted this tip in our general best practices, but it deserves repeating. Accounts should be single-use.

In the next installment of this three-part series, I’ll discuss ‘nix credentialed assessments and options for securing that process.

Note: There are alternatives to credentialed network scanning, such as agents and passive assessments. 

Learn More

Read the online documentation:

• Tenable.io Credentialed Scans
• Tenable.sc Credentialed Scans
• Nessus Credentialed Scans

Explore related webinars:

• Automate Your Credentialed Vulnerability Assessments
• Overcoming the Challenges of Credentialed Scanning

Watch how-to videos:

• Launch a Credentialed Scan with Nessus Professional
• Launch a Credentialed Scan in Tenable.sc
• Launch a Credentialed Scan in Tenable.io

Request a demo or free trial

vBulletin released patches for an undisclosed security vulnerability, encouraging users to apply the patch as soon as possible.

Background

On May 7, vBulletin, a popular online forum software, announced a patch for a security vulnerability in its software. While details have not yet been disclosed, vBulletin said it is “imperative” that users of their software patch the vulnerability as soon as possible. Based on what we've seen from previous vBulletin vulnerabilities, we anticipate attackers will attempt to attack vulnerable sites as soon as details become available.

Analysis

CVE-2020-12720 is an access control related issue in the vBulletin software. Full details about the flaw are not yet public. However, Charles Fol, a security engineer at Ambionics who reported the vulnerability, has tweeted that CVE-2020-12720 is “critical” and that users should patch their software. Fol plans to provide further information about the flaw during the SSTIC conference from June 3-5.

vBulletin released a patch addressing a critical vulnerability I reported through @ambionics. Patch your software. Details will be released during @sstic.

— Charles Fol (@cfreal_) May 8, 2020

vBulletin sites were attacked in less than 24 hours after CVE-2019-16759, a remote code execution flaw, was anonymously disclosed via the SecLists.org security mailing list in September 2019. Therefore, it’s reasonable to assume that attackers will attempt to reverse engineer the patch and craft exploit code based on what the security patches change in vBulletin’s code.

Proof of concept

At the time this blog was published, no proof-of-concept (PoC) code was available for this vulnerability. We expect more information, including a PoC, may become available following Fol’s talk at SSTIC in early June.

Solution

Users can download respective patches for the following versions in the Member’s Area of the vBulletin forums:

• 5.6.1 Patch Level 1
• 5.6.0 Patch Level 1
• 5.5.6 Patch Level 1

Users of vBulletin Cloud sites have already had the patch applied and do not need to take any action.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• vBulletin Forum Post for CVE-2020-12720
• Tenable blog for CVE-2019-16759

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

After back-to-back months of patching more than 100 CVEs, Microsoft released another 111 CVEs this month, none of which were publicly disclosed or exploited in the wild.

Microsoft addressed 111 CVEs in the May 2020 Patch Tuesday release, just short of the 113 CVEs seen in April. The updates this month include patches for Microsoft Windows, Microsoft Edge, ChakraCore, Internet Explorer, Microsoft Office, Microsoft Office Services and Web Apps, Windows Defender, Visual Studio, Microsoft Dynamics, .NET Framework, .NET Core and Power BI.

CVE-2020-1117 | Microsoft Color Management Remote Code Execution Vulnerability

CVE-2020-1117 is a remote code execution vulnerability in the Windows Color Management Module ICM32.dll due to how objects are handled in memory. An attacker that convinces a user to interact with a malicious link can execute commands on the vulnerable machine with the same rights as the active user.

CVE-2020-1126, CVE-2020-1028, CVE-2020-1136, and CVE-2020-1150 | Media Foundation Memory Corruption Vulnerability

CVE-2020-1126, CVE-2020-1028, CVE-2020-1136, and CVE-2020-1150 are memory corruption vulnerabilities that exist when Windows Media Foundation improperly handles objects in memory. Exploitation of these vulnerabilities could allow full system access to an attacker.

CVE-2020-1118 | Microsoft Windows Transport Layer Security Denial of Service Vulnerability

CVE-2020-1118 is a denial of service (DoS) vulnerability found in the Windows implementation of Transport Layer Security (TLS) due to improper handling of certain key exchanges. An attacker who successfully exploits this flaw can cause the target system to stop responding. Utilizing a specially crafted request against a system utilizing TLS 1.2 or lower, an attacker can trigger the DoS condition causing a system to automatically reboot.

CVE-2020-1023 and CVE-2020-1024 | Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2020-1023 and CVE-2020-1024 are remote code execution vulnerabilities in Microsoft SharePoint when it fails to correctly check the source markup of an application package. An attacker who successfully exploits these vulnerabilities could run arbitrary code in the context of the SharePoint server farm account and the SharePoint Application pool. Exploitation of this flaw would require an attacker to successfully upload a specially crafted SharePoint application package to a vulnerable version of SharePoint.

CVE-2020-1069 | Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2020-1069 is a remote code execution vulnerability that exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An attacker who successfully exploits this vulnerability could run arbitrary code in the context of the SharePoint application pool process. The exploitation of this flaw requires the attacker to have authenticated access before they can craft and invoke a specially crafted page on a vulnerable version of Microsoft SharePoint Server.

CVE-2020-1054 and CVE-2020-1143 | Win32k Elevation of Privilege Vulnerability

CVE-2020-1054 and CVE-2020-1143 are both elevation of privilege vulnerabilities in Windows, which are a result of the Windows kernel-mode driver improperly handling objects in memory. In order to exploit these vulnerabilities, an attacker would need to log on to a system in order to execute a crafted application. Both of these CVEs are rated as ‘Exploitation More Likely’ by Microsoft.

CVE-2020-1135 | Windows Graphics Component Elevation of Privilege Vulnerability

CVE-2020-1135 is an elevation of privilege vulnerability in the Windows Graphics Component, due to improper handling of objects in memory. A local attacker could exploit this vulnerability by executing a crafted application to take control of an affected system.

CVE-2020-0901 | Microsoft Excel Remote Code Execution Vulnerability

CVE-2020-0901 is a remote code execution vulnerability in Microsoft Excel caused by an error in how objects are handled in memory. To exploit this vulnerability, an attacker must entice a user to open a specially crafted file with a vulnerable version of Microsoft Excel. While Microsoft rates this flaw as ‘Exploitation Less Likely,’ attackers frequently use malicious emails in attacks, and the current work-from-home situation offers greater opportunities for malicious actors to take advantage of flaws like this one.

CVE-2020-1171 and CVE-2020-1192 | Visual Studio Code Python Extension Remote Code Execution Vulnerability

CVE-2020-1171 is a remote code execution vulnerability that exists in Visual Studio code when the Python extension loads configuration files after opening a project, whereas CVE-2020-1192 exists when the Python extension loads workspace settings from a notebook file. Successful exploitation of either vulnerability would result in the execution of arbitrary code in the context of the current user.

If the current user has administrative rights, an attacker could create accounts with full administrative rights, install malicious applications, and view, modify or delete files. To exploit CVE-2020-1171, an attacker would need to convince a victim to open a specially crafted file in Visual Studio Code with the Python extension installed. The exploitation of CVE-2020-1192 requires an attacker to create a repository with malicious code, then convince a victim to clone this repository and open it in Visual Studio Code with the Python extension installed.

CVE-2020-1153 | Microsoft Graphics Components Remote Code Execution Vulnerability

CVE-2020-1153 is a remote code execution vulnerability in the Microsoft Graphics Components due to the way objects are handled in memory. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code. In order to exploit the flaw, the attacker would need to utilize social engineering tactics to convince a user to open a specially crafted file containing the exploit code.

Tenable solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains May 2020.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s May 2020 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

• Microsoft's May 2020 Security Updates
• Tenable plugins for Microsoft May 2020 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

The economic impact of COVID-19, which is causing record unemployment, creates a golden opportunity for scammers looking to target vulnerable people desperate for cash to help pay their bills.

As Cash App steps up the frequency of its giveaways, and celebrities and other notable figures launch giveaways of their own, scammers are brushing off old tricks in a rush to exploit them.

Over the last few months, we’ve outlined how the novel coronavirus and COVID-19, the disease it causes, has been leveraged by cybercriminals, scammers and opportunists seeking to take advantage of global interest, fears and uncertainty surrounding the virus. In our summary about scammers, we highlighted how they have shifted gears to capitalize on the economic uncertainty posed by COVID-19.

Now, we’re seeing scammers doubling down on the technique known as advance fee scam or “flipping,” along with more blatant use of impersonation tactics of celebrities and notable figures. Scammers have also expanded their preferred platforms to include Venmo and PayPal, alongside the ever-present Cash App.

In October 2019, I shared my research into the underbelly of scams on Cash App, a popular peer-to-peer (P2P) payment service operated by Square, Inc., which reported having 24 million monthly active users earlier this year. In a two-part blog series, I highlighted how scammers are targeting Cash App giveaways on Twitter, as well as giveaways on Instagram and YouTube videos claiming to show users how to earn free money via Cash App. In the months since, these scammers have continued their efforts unabated. What’s changed, however, is the opportunity provided by the economic fallout of COVID-19.

Image Source: CNN

As unemployment “permeates the economy,” with over 30 million individuals filing for unemployment insurance in the United States between mid-March and the end of April, the economic impact of COVID-19 will be felt for some time to come.

With that in mind, organizations like Square as well as celebrities and other notable figures are trying to lessen the pain for some by giving money away using P2P payment applications such as Cash App, Venmo and PayPal through promotions on social media sites like Twitter and Instagram. While these efforts are noble and appreciated, they are putting many vulnerable individuals at risk of being taken advantage of by opportunistic scammers.

Two methods used to perpetrate advance fee scam in giveaways

It’s important to understand the general idea of the most prevalent scams that have persisted throughout Cash App giveaways over the last few years. Underpinning most of these giveaway scams is a confidence trick known as advance fee scam, in which a victim is asked to pay a smaller fee up front before receiving a greater sum of money in return. A victim typically pays the fee but never receives the promised payout. The advance fee scam originated with the Spanish Prisoner confidence trick in the late 18th century. The modernized version was first observed in 1922 and rose to prominence in the 1980s. The only difference today is the vehicle used to perpetrate this type of fraud, which is often referred to as “flipping” cash nowadays.

The built-in audience on social media provides fertile ground for scammers to target the vulnerable. Coupling that with the advent of P2P payment applications has made it that much easier for this type of fraud to take place at scale.

The core of the fraud is still the same: provide money up front, and the scammers claim they will be able to turn it into a larger sum, whether it’s twice or up to 10 times as much. There are two particular methods scammers leverage when perpetrating cash-flipping during these giveaways.

1. Signal boosting: The simplest way to entice users into participating

The most notable cash-flipping method involves scammers offering a particular sum of money — which could be fixed (e.g., $500) or variable (e.g., $200-500) — to users who signal boost their social media posts by retweeting and/or “liking” (favoriting) their content. This approach is extremely popular because it requires no upfront financial investment from the user, instead leveraging their social capital. By convincing users to retweet and like their content, the scammers use unsuspecting victims to spread their scam to a wider audience of people.

In addition to asking users to spread their message, the scammers also ask for their P2P payment identifiers (IDs). P2P payment applications have IDs like usernames (or as Cash App calls them, $cashtags) or short URLs (such as the PayPal.me URL) to make it easier to send and receive money.

The scammers will also ask users to send them direct messages (DMs), where the con takes hold.

Users who engage with these scammers via DMs will be asked to provide a fee up front (hence the term advance fee scam). They will either claim they are capable of “flipping” a transaction through a P2P payment application, turning it into a larger denomination (e.g., they’ll claim they can turn $50 into $500) or they will claim they need the user to provide them a “receiver’s fee” before they can access their money. In reality, these requests are part of the ruse to convince a victim to part ways with their money before the scammers block them on social media.

WARNING: If you come across tweets claiming to be giving away money to users that retweet (RT) and like (favorite) a tweet, don’t fall for it. It’s a scam.

2. Incoming requests from impersonators asking users to “verify” with a small fee

Since most of the giveaways on social media involve users sharing their P2P payment IDs in a public forum, the scammers don’t have to do a lot of legwork to target their victims — it’s there in plain sight. The scammers act like predators waiting for their victims at a proverbial watering hole.

These scammers harvest P2P identifiers and utilize the “request money” feature built into most P2P applications to ask their victims for money. They do so by first creating fake profiles on these P2P applications. These profiles typically impersonate an organization, like Cash App, or a user, oftentimes a celebrity or other notable figure. Because P2P payment applications do not have a way to differentiate between a scammer and a person or organization who is legitimately giving money away, some users are duped into accepting the request and sending money to the scammer. The scammers typically ask for a small fee, which ranges from $1 to $20, though it’s possible the scammers may ask for more. A low “fee” increases the likelihood that the victims will actually follow through with it. This is because, for some victims, the prospect of getting back 10 times the amount of money being requested is worth the risk of being left high and dry.

WARNING: If you receive a request for money on @CashApp, @Venmo or @PayPal asking you to “verify” in order to win a giveaway, don’t accept the request. It’s a scam to steal money from you.

These two methods make up the bulk of the cash-flipping scams I’ve seen over the last few years.

Cash App giveaways increase during pandemic

Historically, Cash App has launched giveaways as part of its Cash App Friday or Super Cash App Friday initiatives, with a few giveaways sprinkled in between. Since the pandemic, Cash App has been posting giveaways more regularly. This activity began on March 18, when Cash App tweeted “We want to help,” implying that it was looking to help individuals who are struggling during this time.

We want to help. Send us your $cashtag pic.twitter.com/Az2ghhOkLs

— Cash App (@CashApp) March 18, 2020

Naturally, the increased activity from Cash App’s official Twitter account with these regular giveaways has provided Cash App scammers a consistent stream of opportunities to target vulnerable individuals.

If you look at any of Cash App’s giveaway tweets, you’ll find it littered with replies from scammers seeking to capitalize on the interest in the giveaways.

These tweets showcase the signal boosting method outlined earlier. One user notified me personally that they had reached out to one of these scammers, who asked them to send $525, claiming they would multiply the transfer times eight, which amounts to $4,200. The scammer also went out of their way to say that they weren’t “one of those scammer types” and that they don’t “want to portray [themselves] as one.” Once this user called out the scammer, they were promptly blocked.

In one instance, a scammer claimed they could offer the user nearly $10,000 if the user first paid “a receiver's fee.”

Irrespective of the amount the scammers claim they will return to their victim, whatever “fee” they ask from their victim will never be returned and they’ll block them once the victim confirms receipt of the transaction.

As I noted in my original research, scammers not only respond to Cash App’s tweets, they also ride the popularity of the Cash App hashtags as they’re trending. For example, Cash App recently began promoting a giveaway by asking users to put their Cash App in their own bios with the hashtag #cashappinbio.

Not long after this tweet was published, it began to trend on Twitter.

Unsurprisingly, scammers seized on the trending hashtag and used it in their signal boosting tweets, in addition to several other popular hashtags like #CashAppFriday, #CashAppBlessing and of course, #COVID19.

Celebrities and notable figures open up their pockets

While Cash App has regularly provided giveaways for a few years now, celebrities and other notable figures have been opening up their wallets as well during these difficult times in an effort to help those struggling financially.

One of the more notable donors is popular beauty influencer Jeffree Star.

I’m going to give away $30,000 to 1 random person who retweets this tweet AND follows Twitter Philanthropist @Pulte and Me!! (If you don’t follow us, we can’t DM you the money) Will show proof! Much love

— Jeffree Star (@JeffreeStar) March 22, 2020

Jeffree Starr’s $30,000 giveaway in March was met with enormous interest, with nearly 1 million retweets, over 600,000 likes and more than 100,000 replies.

Scammers quickly seized on the opportunity provided by Jeffree Starr’s giveaway, as detailed in a story from Quartz, which highlighted these types of scams and shared the tale of how one stranger reached out to a participant in the giveaway, offering them $250 but not without asking for a “fee” up front. In this case, the victim was told it would be a “donation” instead of a “fee,” preying on the victim’s kindness.

Jeffree Star managed to become the number one trending tweet on Twitter on multiple occasions, with an untold number of Twitter users replying to his giveaway using “#JeffreeStarApproved” hoping to win money from him.

Star has also participated in giveaways with Bill Pulte, a philanthropist and self proclaimed inventor of “Twitter Philanthropy,” who regularly does giveaways on Twitter.

I’m going to give away $30,000 to 1 random person who retweets this tweet AND follows Twitter Philanthropist @Pulte and Me!! (If you don’t follow us, we can’t DM you the money) Will show proof! Much love

— Jeffree Star (@JeffreeStar) March 22, 2020

Since promoting giveaways on his timeline, scammers try to leverage Jeffree Starr’s Twitter following by offering to give away money within the replies.

While scammers aren’t shying away from leveraging signal boosting in giveaways from celebrities and other notable figures, they tend to prefer to impersonate these figures on the various P2P payment applications so they can abuse the “request money” feature.

In addition to targeting Cash App users in North America, some scammers are requesting funds from users in British pounds (£).

As mentioned earlier, the requests from these impersonators are purposely set to a lower dollar value because they believe someone would be more willing to part with $5 rather than $500, and their calculation is often right.

Not every impersonator completes their transformation into Jeffree Star. In one case, the impersonator forgot to swap out their own profile photo.

Scams on Venmo and PayPal

While most of the giveaway scams I’ve observed have centered around Square’s Cash App, scammers are also targeting giveaways using other platforms.

Popular social media content creator David Dobrik, who has nearly 5 million Twitter followers and nearly 17 million YouTube subscribers, posted a tweet on March 27 offering to provide people with “extra cash,” asking that they respond by sharing their Venmo username and his team would “send something over.”

If ya know anyone that needs some extra cash lmk their venmo and we’ll send something over :)

— DAVID DOBRIK (@DavidDobrik) March 27, 2020

Scammers seized on Dobrik’s giveaway by creating fake accounts on Venmo and leveraging the second most common method of sending requests for money by targeting those leaving their Venmo IDs in the replies.

Once again, the amount of money the scammers will request can vary, but it is often a smaller denomination. In the example above, the scammers asked for $20. In another example, one particular scammer asked for $2.99. Unlike Cash App, which offers a limited amount of characters in the note when requesting money, the Venmo request clarifies why the scammers are asking for this advance fee upfront. They say it’s for “an account verification to ensure money is sent to valid accounts.”

Venmo isn’t the only target scammers have their eyes on. Because some users aren’t on Cash App or Venmo, they’ll share their PayPal IDs instead.

Some users received requests on PayPal asking for a $10 advance fee, with the promise of receiving $510 in return. The scammers also use the note field to instruct their victims to use the “Friends and Family” option when sending their payment, because the “Goods and Services” option takes “up to 48 hours” to process and that’s enough time for the transaction to get flagged.

Even though Dobrik mentioned that he was going to be giving away money on Venmo, that didn’t stop scammers from also requesting money via Cash App.

Scammers have also been impersonating Pulte across each platform, abusing the same “request money” feature.

Cash App 

Venmo 

PayPal

Popular YouTube creator Ethan Klein has also offered to generously give away $100,000 over a period of 100 days.

We're giving away $100,000 over the next 100 days. #HELPpic.twitter.com/S8RDYclAAu

— Ethan Klein (@h3h3productions) April 14, 2020

I suspected that with this giveaway, the prevalence of users sharing their P2P payment IDs for their PayPal accounts would result in scammers seizing on this opportunity. After all, 100 days of giveaways is a consistent stream of P2P payment IDs and the hope of being selected makes it all the more possible that people will get duped out of their money.

In your H.E.L.P tweets, can you warn your followers that you won’t ask anyone to send them money to “verify” themselves first before they receive their winnings and to report any accounts that do? Thanks for your help in keeping the community safe.

— Satnam Narang (@satnam) April 14, 2020

Sure enough, the scammers did target participants in Klein’s giveaway. Klein has since posted a warning to his followers about it, even providing an example screenshot of the requests for money that scammers are sending.

It looks like this fyi pic.twitter.com/V4lmEDN9A4

— Ethan Klein (@h3h3productions) April 26, 2020

Directing “winners” to contact an “agent”

In some cases, the scammers are impersonating these same celebrities and notable figures on Twitter and Facebook, messaging their victims and instructing them to contact their “agent” via text message.

This is merely a way to get users off the social media platform and onto one like SMS, where it’s a lot harder to stop a scammer with a mobile number.

As the example below shows, when you contact one of these so-called “agents” they once again ask you to provide a “fee” for verification purposes.

Stealing financial information is the holy grail

While the scammers tend to zero in on cash giveaways and leverage the P2P payment applications, that hasn’t stopped them from trying their luck to go after the holy grail: bank account information.

In some cases, scammers are using an image from Cash App saying their bank “declined this payment. Please update your card or contact your bank for more information.” They use this image as a way to trick their victims into believing they can’t send the money via Cash App, which is why they need the user to provide their login credentials for their credit card application.

If users say they can’t pay the so-called “fee” to the scammers, they will be asked if they have a bank account. Once they confirm the existence of a bank account, the scammer will say they can “deposit a check” into the account, but first they need the username and password for the account. This is a retro take on phishing, because instead of directing the users to a fraudulent website that looks like their bank’s website, they’re just merely asking them to provide their login credentials without batting an eye.

Besides directly asking for login credentials, the scammers may also ask users to provide sensitive information, such as their account number, routing number and name on the account.

While the routing number is a piece of public information, your bank account number is not. Having both of these pieces of information would enable the scammer to transfer money out of your account. In this case, they’re not chasing after a small sum of money by abusing the request money functionality of P2P payment apps, they’re looking for the biggest piece of the pie that they can take a bite of.

In-product warnings for users could thwart these scams

While it’s commendable that Jeffree Star and Ethan Klein have tweeted warnings about scammers targeting their giveaways, that can only do so much to help protect vulnerable users. It’s imperative that the P2P payment providers like Cash App, Venmo and PayPal take extra steps to caution their users. I believe this could be achieved by inserting a warning within every request for money received through their applications as a starting point.

We’ve created mockup images of what this could potentially look like. Please note these are not currently implemented in any of the P2P payment applications nor are we aware if they have considered anything of the sort.

Cash App Mockup Warning Message

Venmo Mockup Warning Message

PayPal Mockup Warning Message

If users see this information up front when they receive requests for money within their preferred P2P payment app, they’ll know right away that they shouldn’t accept the request. This could help thwart many of the incoming requests for money from scammers targeting those participating in giveaways.

The same concept could be applied as part of sending money to users as well. Providing the end user with a warning message to the effect that “anyone claiming they can increase your money for a small donation or upfront payment is a fraud” could potentially save some users from parting with their money.

Verified accounts on P2P payment platforms

The use of verified badges, which are used to confirm celebrity or brand authenticity on social media, is one way to help users avoid falling victim to impersonators. However, verified badges are not without flaws, as highlighted in a piece for The Atlantic by Taylor Lorenz. There are plenty of examples where verified accounts have been compromised and used to peddle scams, including a recent blog we wrote regarding cryptocurrency scams on Twitter.

P2P payment applications have had no verification mechanism in place. It’s a blank canvas, therefore there’s an opportunity for the companies in this space to start utilizing verification on a case-by-case basis. For example, Square’s Cash App is identified by their cashtag, $cashapp. They can and should verify their own account so users can visually see the difference between a transfer of money from Cash App versus a request from an impersonation of Cash App.

Similarly, the giveaways by celebrities and notable figures can be easily identified by these companies. For instance, Jeffree Star has reached out to Cash App to try to get “verified” in order to increase the limits put in place by Cash App when sending money.

Hi @CashApp, I'd love it if you could verify my account so I can raise the daily limit of $ I can SEND. Just hit the limit after sending to 20 + people! Thank you so much! #JeffreeStarApproved

— Jeffree Star (@JeffreeStar) March 21, 2020

Cash App is already requesting information such as the last four digits of a social security number. They could also put a mechanism in place to verify these celebrities and other notable figures who are giving money away using their platform. Because more often than not they announce their giveaways on social media. For instance, rappers Lil Nas X and Megan Thee Stallion gave away money using Cash App back in March, and of course, scammers quickly seized on their generous giving.

These are far from perfect solutions. However, a combination of in-product warnings along with verification badges for those celebrities and other notable figures doing giveaways could go a long way to help protect some users from being defrauded.

Digital philanthropy: The good and the bad

The efforts made by companies like Square (via Cash App), celebrities and other notable figures to give money to those struggling through this period of economic uncertainty should be lauded. At the same time, it’s important to recognize that these efforts also create an environment where scammers thrive. And it’s clear that their efforts are working, because if they weren’t, they wouldn’t be pursuing them any further. That’s why it’s important to disrupt their activities as much as possible. This won’t be achieved through user education and awareness alone. Product changes that can be introduced into the user interface of these P2P payment applications can play an important role in this process.

Until such product changes are considered and implemented, it’s up to users to do their part to stem the tide of scams. Here are six tips to help users protect themselves:

1. Any time you’re asked to pay a fee to “verify” yourself, make a “donation” or any other reason that requires you to pay a fee up front (in advance), it is a complete scam.
2. If you receive an incoming request for money in your Cash App, Venmo or PayPal to verify you’re real, ignore the request and report the user. Neither Cash App nor any celebrity or notable figure offering to give away money will ever ask you to send money as a form of verification.
3. Be skeptical of people posting on Twitter and Instagram promoting their own giveaways using hashtags like #CashAppFriday, #SuperCashAppFriday, #cashappinbio, #BailoutHumansNow, #JeffreeStarApproved and #COVID-19
4. If you’re asked to provide the login credentials to access your bank account or credit card account, don’t share those details with anyone. These users are trying to “phish” you of your sensitive logins and passwords so they can pull a large sum of money out of your account.
5. If you receive a message from someone saying you’ve won a Cash App giveaway and they include a link to a website that asks you to log in to your Cash App, it is almost certainly a phishing site. Do not enter your mobile number or provide your “login code” into any website. Instead of clicking on a link in a DM or a social media post, visit the real Cash App, Venmo and PayPal websites or check your mobile applications instead.
6. “Flipping” money isn’t real. There is no program or method to alter transactions to increase the value within Cash App or any other P2P payment service. If the proof offered to you is flipping $2 for $20, it means the Cash App scammer is using their own stash of funds to gain your trust in order to steal a larger sum of money from you.

While Venmo and PayPal currently do not offer such a feature, Cash App allows users to restrict who can send them an incoming request for money. This can be achieved by changing the setting to “Contacts Only,” which will thwart the Cash App scammers impersonating Cash App and other celebrities and notable figures through incoming requests, asking for money for verification purposes. Even with this setting enabled, you’ll still be able to send and receive money through Cash App normally.

As long as Cash App, generous celebrities and notable figures give away money on social media, these types of scams will persist. Since such giveaways won’t be stopped, the only way to truly stymie the efforts of these scammers is to put roadblocks in their way, such as the product-related changes we’ve proposed in this article.

Join Tenable's Security Response Team on the Tenable Community.

Following initial reports that attackers were exploiting a vulnerability in Oracle WebLogic Server, researchers have shared more information about the flaw and its connection to CVE-2020-2555, just as a proof-of-concept has become available.

Background

On April 14, Oracle released its Critical Patch Update (CPU) for April 2020, a quarterly round-up of fixes across its product line that addressed hundreds of CVEs, including 51 patches in Oracle Fusion Middleware. On April 30, Oracle published a blog post strongly encouraging customers to apply these patches “without delay.” This was prompted by reports the vendor had received suggesting attackers were attempting to exploit “a number of recently patched” flaws, including a critical vulnerability in Oracle WebLogic Server.

Analysis

CVE-2020-2883 is a deserialization vulnerability in Oracle WebLogic Server, specifically in the Oracle Coherence library, an in-memory data grid solution that compresses/decompresses data (both serialized and unserialized) to provide fast access to frequently used data across a grid of assets. To exploit the flaw, a remote, unauthenticated attacker would need to send a specially crafted request to the T3 port on a vulnerable WebLogic server. Successful exploitation would result in the attacker gaining remote code execution.

Sivathmican Sivakumaran, a vulnerability researcher at The Zero Day Initiative (ZDI) published a blog post on May 11 that provides further details on the vulnerability.

CVE-2020-2883 is a bypass of CVE-2020-2555

In March 2020, Sivakumaran published a blog about CVE-2020-2555, another deserialization vulnerability in Oracle WebLogic Server, which was patched in Oracle’s CPU for January 2020. It was reported to Oracle by Jang Nguyen, a researcher at VNPT Information Security Center (ISC).

Nguyen has published “The Art of Deserialization Gadget Hunting,” a three-part series on the VNPT blog. On March 12, Nguyen reported in the third part of the blog series that CVE-2020-2555 was not completely fixed.

Source: VNPT ISC Blog (Translated)

Sivakumaran also noted this incomplete fix in his blog.

Source: ZDI Blog on CVE-2020-2883

Quynh Le of VNPT ISC reported the bypass through ZDI, though Nguyen is also credited with finding CVE-2020-2883 on Oracle’s April CPU page along with a few other researchers.

For full details about the vulnerability, including a full gadget chain along with exploitation video demos, please refer to Sivakumaran’s blog post.

Expanded attack surface: Oracle Business Intelligence

As previously noted, this vulnerability resides in the Coherence library. Coherence can be used in Web Application servers such as WebLogic, Glassfish, Hibernate and Spring, and is embedded in many other Enterprise Applications created using the Oracle Fusion Middleware/WebLogic Application suite. In addition to Java-based applications, it can also support C++ and .NET clients per its documentation.

Sivakumaran’s blog specifies that other applications would also be vulnerable if the Coherence library is “in its code path where there is a path to deserialization.” As an example, he cites Oracle Business Intelligence, due to the fact that it is “deployed on Oracle WebLogic.”

Sivakumaran also mentions pairing one of the gadget chains from his blog post to exploit a separate vulnerability, CVE-2020-2950, a deserialization vulnerability in Oracle Business Intelligence, which would also result in remote code execution.

CVE-2020-2883 exploited in the wild

Details about the in-the-wild exploitation of CVE-2020-2883 are understandably limited at this time. However, the availability of exploit code for CVE-2020-2555 and a similar gadget chain exploit path has provided attackers with enough information to exploit this flaw. Additionally, Oracle’s use of the phrase “without delay” in its blog post underscores the importance of patching this flaw as soon as possible.

Proof of concept

Security researcher “Y4er” published a PoC to a GitHub repository on May 10 for CVE-2020-2883. The researcher previously published a PoC framework for CVE-2020-2555 on March 8. The instructions for CVE-2020-2883 include cloning the CVE-2020-2555 framework as the first step before utilizing the CVE-2020-2883 PoC.

Tenable Research engineers have confirmed exploitation of this remote code execution vulnerability on an Oracle WebLogic Server version 12.2.1.4 Linux asset within the Tenable Research labs. We have not yet confirmed exploitation of a Windows asset as of yet.

In the GIF above, we show the exploit successfully executed on the left side of the screen with the remote asset querying the attackers web server searching for the “TenableResearch_CVE-2020-2883_PoC” file.

Using a slightly different attack, we are able to create a reverse shell to the attacker’s PowerShell terminal, as shown in the GIF below.

Solution

Oracle released patches for CVE-2020-2883 and CVE-2020-2950 as part of the Oracle CPU for April 2020. The following versions of WebLogic Server are affected:

We strongly recommend applying those patches as soon as possible. Oracle also published security guidance to restrict the Oracle WebLogic Server T3/T3S protocol traffic if patching is not an option or to further secure a patched version.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities can be found here.

Get more information

• ZDI Blog on CVE-2020-2883
• ZDI Blog on CVE-2020-2555
• VNPT Blog on Deserialization Gadget Hunting for CVE-2020-2555
• Y4er's Proof of Concept for CVE-2020-2883

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

The rise of open-source software means greater speed and efficiency for developers, as well as heightened security risks. Here's how DevOps teams can protect their containerized applications against undisclosed vulnerabilities. 

Application developers have transitioned from writing custom code to assembling reusable components and open-source libraries. This approach enables rapid iteration and more continuous deployment for DevOps teams. But, it can also increase cyber risk if developers unknowingly use vulnerable open-source code. 

Open-source software is everywhere, especially in containerized environments. Recent studies show: 

• 96% of codebases include open-source components ¹
• 60% of codebases have at least one open-source vulnerability ²
• The mean time to identify and fix a vulnerability in an open-source package is two years ³

So, why is open-source software taking off? The biggest reason is it saves time. Rather than writing custom code and reinventing the wheel for every task, developers leverage open-source projects and tools for the bulk of the work and write custom code on top of it to tailor the component to their needs. This enables rapid iteration and continuous deployment of new features in applications. Also, in most cases, the price of open-source software can’t be beat. Open-source projects are almost universally free and come without the strings of terms and conditions or long procurement cycles. 

But, these benefits come at a cost. In fact, there’s been a 71% increase in open-source breaches in the last five years,⁴ including the 2017 Equifax breach that exposed over 145 million records. 

Why software composition analysis is essential

To catch vulnerabilities in these open-source libraries, you need software composition analysis (SCA). SCA is the process of scanning open-source project repositories for vulnerabilities, even if they haven’t been disclosed to the U.S. National Vulnerability Database (NVD) and assigned a CVE number. 

With SCA, open-source users are alerted to vulnerabilities in application language libraries that other scanners searching solely for registered vulnerabilities miss. Without SCA, security and DevOps teams are blind to vulnerabilities in components that account for up to 85% of their applications.⁵

There’s no prescribed patching or user notification process for open-source software, and users are at the mercy of the community that supports a particular project for critical fixes. The variability in patching and updates across various open-source projects has forced some teams to manually track open-source software versions in use and their most recent patches using spreadsheets, which just isn’t viable at scale. 

SCA replaces those spreadsheets and eliminates the guesswork of determining whether a specific open- source component is vulnerable by: 

• Discovering all components in use
• Assessing these components for vulnerabilities
• Providing remediation guidance, including available patches

SCA helps manage vulnerabilities in open-source software and should be incorporated into an organization’s overall risk-based vulnerability management program. 

Tenable adds SCA to Container Security for host-to-code coverage

Tenable is partnering with Snyk, a leading provider of SCA in containerized applications. This integration means you can both assess containerized applications from the host infrastructure all the way to the application code and actively test the running application. This platform approach saves you the hassle of screen-switching between point solutions, which not only leads to product fatigue, but creates data silos across the security team. 

The Snyk integration offers a seamless user experience within Tenable.io Container Security, with open-source code vulnerabilities in Ruby, Python and Node.js appearing alongside all other vulnerabilities in a single interface. Support for additional open-source libraries will be added over time. Simply navigate to the Image Details overview to view all vulnerabilities in a particular container image, including OS-level and open-source component issues.

Tenable.io Container Security integrates into all of the most popular container registries and build pipeline tools to identify vulnerabilities and policy violations in container images before they’re deployed in production. Tenable.io Container Security allows security teams to keep pace with DevOps and secure modern applications from host infrastructure all the way to the running application when combined with Tenable.io Vulnerability Management and Tenable.io Web App Scanning.

Try Tenable.io Container Security for free for 30 days

The combination of Tenable.io Container Security and Snyk Intel, Snyk’s open-source vulnerability database, is a powerful defense against the risks of open-source software that enables you to securely develop the cutting-edge applications your customers demand.

We encourage you to evaluate it for yourself and see Tenable.io Container Security in action. Click below to sign-up for your free 30-day trial and secure your container images today.

Start free trial

_{1. Synopsis, “2019 Open Source Security and Risk Analysis,” April 2019
2. Ibid
3. Synk, "The State of Open Source Security Report 2019,” February 2019
4. Sonatype, “DevSecOps Community Survey 2019,” March 2019
5. Ibid}

As organizations adapt to work-from-home mandates, we detail the three most common configurations for securing your remote workforce using Nessus Agent deployments.

In several of our recent blog posts, we’ve discussed the various reasons that organizations, including government agencies, might deploy Nessus Agents to protect their newly distributed workforces. As part of the changes precipitated by emergency remote work mandates, it’s important to maintain vulnerability metrics for your entire organization. These scans are crucial to protecting assets that have changed location from the office to employees’ households, as well as new assets like personal laptops and phones being introduced into your enterprise IT environment.

Nessus Agents are a perfect way of conducting this due diligence. They enable local scan policies on devices that are not dependent on a connection to the office network. Outside of a work-from-home situation, Nessus Agents are also excellent alternatives for gathering vulnerability information on hosts that have frequently changing credentials and assets that have been hardened to prevent external login.

Three ways to set up your Nessus Agent deployment

There are several ways to architect a Nessus Agent deployment depending on your specific needs. Detailed below are a few of the most common use cases.

1. Standalone Tenable.io

Tenable.io has the native capability to communicate with Nessus Agents over the internet. This is ideal for prospective or current Tenable.io customers that want to deploy agents quickly and utilize Tenable-provided, cloud-facing scanners as an “eye in the sky” for assets not typically visible to internal scanners. The diagram below depicts this configuration, which requires no additional deployment outside of the Nessus Agents on each host. You can read our recent blog for further instructions on how to configure Nessus Agents with Tenable.io.

2. Tenable.io as proxy to on-premise Tenable.sc

Tenable.io can also be used as a proxy for Nessus Agents to Tenable.sc. This is a great scenario for organizations that have limited resources for managing additional infrastructure, or those that may not control the external pieces of their network. In this configuration, the Nessus Agent gets its scan instructions from the user’s Tenable.io container and aggregates the data back to Tenable.io. From this point, the data is ready to be ingested into an internal Tenable.sc console for a holistic view with the rest of the internally-available data. 

This solution is great for customers who want to have external visibility of their data without a VPN connection to the internal network. They enjoy simplified scanning of their external assets with the available cloud scanning capabilities found within Tenable.io, as well as easy agent data aggregation and the mature reporting structure of Tenable.sc. You can visit our Tenable Community article for easy step-by-step instructions on how to link your Nessus Agents across Tenable.io and Tenable.sc.

3. Standalone Tenable.sc

If you are using the Tenable.sc platform, Nessus Manager can act as a proxy for Nessus Agents. There are two ways to architect this setup: 

Placing Nessus Manager in the demilitarized zone (DMZ)

This scenario is beneficial for organizations with lots of devices that are off the corporate network and don’t reliably connect to a VPN for internal access. This is becoming a much more prominent method of operation as single sign-on (SSO) solutions and forward-facing web applications replace the need to use a VPN for the majority of a person’s workday. 

A firewall rule can be made between the internal Tenable.sc console and the Nessus Manager residing in the DMZ. This allows Tenable.sc to collect the data without creating additional risk of exposure. Additionally, customers can change the management port so the administrative interface of Nessus Manager isn’t exposed to the Internet. This ensures that any device with an agent and internet connection can still reach the Nessus Manager, and removes the limitation of needing a VPN solution to collect scan data.

Placing Nessus Manager inside the organization’s network

Another option for Nessus Manager is to deploy it within your enterprise network, usually on the same segment as the Tenable.sc console. This is advantageous for organizations that have employees who reliably connect to a VPN, or any organization that wants to maintain vulnerability data within its network. In this situation, you can scan devices for real-time vulnerabilities as they connect to the VPN, without the worry of missing an active scan cycle from a Nessus Agent. This strategy reduces the likelihood of an active Nessus scan saturating a VPN link. Instead, each host uses its own resources and the results are staggered back to the network.

A note on large-scale deployments

Every piece of guidance is enhanced by additional documentation, and Nessus Agent deployment is no exception. For large scale considerations, Tenable provides documentation that contains helpful tips around the scaling relationship between Nessus Agents and Nessus Managers, scan staggering and automated deployment mechanisms. As always, the Tenable Community is another great place to post questions and read about the experience of other security managers.

Secure your workforce with special surge licenses

In recent weeks, we’ve received many inquiries from customers asking for guidance around securing their added remote workforce assets. We’re eager to help the security community protect these newly mobilized workforces, and towards that end we are offering multiple short-term licensing options:

• For Tenable.sc and Nessus Professional customers: We are offering a free Tenable.io license with unlimited agent scanning available through June 15, 2020.
• For Tenable.io customers: Tenable will help you extend existing Tenable.io licenses immediately, for free, through June 15, 2020. 
• For prospective Tenable customers: We offer free trials and evaluation licenses to give you first-hand experience with the products prior to purchase. Request a demo or free trial to learn more about how Nessus Agents can help manage your cyber risk.

For more information on the latest research findings and vulnerability advisories during the COVID-19 response, visit our Tenable resource page on protecting your remote workforce.

This is the third installment in our three-part series exploring how to use Tenable products to protect credentials used for network assessments. Here, we focus on ’nix style systems: Linux, Unix and macOS.

In part 1 of our three-part series, I covered general best practices for protecting credentials when performing network assessments. In part 2, I provided specific guidance for Windows systems. In this third and final post in the series, I take a look at protecting credentials authenticating against ’nix hosts (by ’nix, we mean Linux, Unix, and macOS), specifically focused on SSH.

Please note that enabling some of these controls may have other effects on your network and systems. Before you implement any of these changes, you should test all settings thoroughly to determine if they are appropriate for your environment. Not all organizations will be able to implement all these settings. When configuring account(s) for use in credentialed scanning, below are some key considerations unique to ’nix hosts.

5 tips for credentialed scanning of ‘nix hosts

1. Securely configure SSH.
   There are more than a dozen different configuration changes you can make to an SSH server to make it more secure. We won’t go into them all here, but a great place to start is to take a look at the recent benchmarks from CIS for your target operating system. Some, like Ubuntu and CentOS, have specific SSH sections that should be reviewed in their entirety. You can also use Nessus to check many of these specific configurations.
2. Use least privilege functionality to limit what access is needed.
   Full root or sudo privileges can be a risk in certain environments. Using Nessus, you can test to see exactly what privileges are needed to run vulnerability and compliance assessments in your environment and only allow access to what’s needed.
   
3. Use unique accounts for authentication and assessments.
   The ’nix subsystem allows for the option of using unique accounts for remote authentication and actually running the tests with plugins using ‘su’ or a combination of this and ‘sudo.’ Consider configuring this in Nessus.
4. Use SSH keys or certificates.
   Using a username/password to authenticate to a system with SSH usually means you implicitly trust your target systems, as a rogue or compromised system could be configured to steal your scanning credentials. Use SSH keys or certificates to mitigate this. Strongly consider setting up or using existing management tools to manage SSH key or certificate deployment and revocation.
   
5. If using SSH keys, encrypt the private key.
   A compromised unencrypted private key could mean full access to your internal infrastructure, just like a remote code execution vulnerability. Ensure your SSH keys are secured with a passphrase.

Note: There are alternatives to credentialed network scanning, such as agents and passive assessments. 

Learn More

Read the online documentation: 

• Tenable.io Credentialed Scans
• Tenable.sc Credentialed Scans
• Nessus Credentialed Scans

Other blog posts in this series: 

• Overview: How to Protect Scanning Credentials
• 5 Ways to Protect Scanning Credentials for Windows Hosts

How-to videos:

• Use SSH Public Key Authentication in Tenable.io
• Credentialed Linux Scans in Tenable.io

Legacy vulnerability management tools can no longer keep up with the expanding attack surface. Now is the time to focus your remediation efforts on the vulnerabilities that pose the greatest risk to your business. 

There’s a growing understanding among security professionals that legacy vulnerability management tools simply aren’t cutting it anymore. Between the expanding attack surface, the growing number of vulnerabilities, and the increasing speed and complexity of cyber threats, you simply don’t have the time or resources to remediate everything. And since more vulnerabilities – roughly 1,500 every month ¹– are continuously discovered while you’re busy dealing with others, it’s easy to feel like you’re losing a frenzied game of Whac-A-Mole.

What you really want to do is focus on what matters most. That means finding the vulnerabilities that pose the greatest potential risk to your organization, and then determining which of them reside on your most critical assets. After all, it’s that combination—vulns with the highest risk, residing on your most important assets—that makes them your highest priority.

Of course, that level of focus isn’t possible if you’re using legacy vulnerability management tools. To succeed, you need to evolve your VM program to embrace a risk-based approach.

The pitfalls of legacy vulnerability scanning

You can’t protect what you can’t see. If your scanner can only assess traditional IT assets, you’re missing any vulnerabilities that are present in the most dynamic aspects of the modern attack surface—including those residing in cloud, operational technology (OT) and container environments.

Legacy scanners also lack any degree of insights into the vulnerabilities they uncover; while they are extraordinary tools for finding vulnerabilities in traditional on-premise IT environments, that’s the full extent of their limited powers. Using these tools results in a flat CSV file that simply lists the organization’s vulnerabilities, with no context, color, or additional analysis of any kind.

In addition to an expanded set of tools, organizations need to update their VM policies and procedures to keep pace with evolving cyber threats. For example, scanning once a month or less means that you’re basing decisions on old, outdated information. And prioritizing remediation efforts forces you to make critical decisions in the dark, without any sort of context or color.

Getting started with a risk-based approach

Risk-based vulnerability management may seem complicated, but it can be a relatively painless migration if you know what to expect and plan accordingly. And once you’ve implemented it, you can reap myriad long-term benefits. This includes providing your team with the ability to prioritize the vulnerabilities and assets that matter most, proactively managing the organization’s cyber risk, and making strategic decisions rather than waiting until a security event occurs and then shifting into panic mode.

Now is the time for organizations to get ahead of the vulnerability overload problem. By 2022, Gartner forecasts that organizations that use risk-based VM will suffer 80% fewer breaches than those that don’t.² That’s why Tenable is hosting a special webinar later this month, How to Evolve to Risk-Based Vulnerability Management, to help you navigate this brave new world. I’ll be joined by Tenable Chief Security Strategist, Adam Palmer, to discuss:

• How to discover and map every asset across your entire attack surface to eliminate blind spots
• The importance of frequent scanning, dynamic discovery of new assets, and continuous assessment of known assets
• Why it’s so essential to prioritize your remediation efforts in the context of business risk, and how to add that context without getting buried in more data
• How to proactively address the vulnerabilities that pose the most risk while minimizing disruptions from new vulnerabilities and zero-day exploits that gain media attention

Stop relying on outdated methods that are failing you and creating more work for the team. Instead, get on the path to implementing a risk-based vulnerability management strategy to maximize the team’s efficiency while reducing risk. Want to learn more? Sign up for our webinar below to learn what’s required to succeed.

Register Now

_{1. Figure is based on data from the U.S. National Vulnerability Database, which recorded 17,313 new vulnerabilities in 2019.
2. Gartner, "A Guide to Choosing a Vulnerability Assessment Solution," April 2019}

For critical infrastructure organizations, the gains of automation and IoT technology have also meant heightened threats. These are the steps security directors can take to reduce cyber risk across their industrial operations.

Companies and organizations are inherently risk-averse. Having regular and predictable business cycles, cash flows and monthly recurring revenues is rewarded by investors and stakeholders. When a company takes on risk, the decision is almost always scrutinized with a cost-benefit analysis. While some forms of risk are manageable and others are not, it is incumbent upon organizational leaders to eliminate risk wherever possible and manage the risk that is impossible to eradicate.

Risk management is paramount for organizations that provide “critical infrastructure” services, whose operational technology (OT) ensures the fabric of our national security and modern ways of life. Many countries have independently identified which vertical industries are considered critical in their region. In the United States, the Department of Homeland Security has identified sixteen distinct critical industries that are of strategic importance. As these sectors have modernized their operations in recent decades, the gains in efficiency have also brought new attack surfaces.

Source: www.cisa.gov

How automated systems expose infrastructure to cyber threats

Over the course of the last two months, we have become quite familiar with the term “essential workers” and the risks associated with scaled-down workforces. But this is only part of the critical infrastructure equation. Virtually every vertical in the “DHS-16” also relies on automation to produce and deliver their essential product or service. Everything from generators and turbines to actuators and robots is all controlled by programmable logic controllers (PLC) and the greater OT environment to make things happen. Without their flawless operation, we would not be able to generate electricity, drink clean water or benefit from any of the other critical products or services that define “normal” life.

Risk is constantly changing and critical infrastructure organizations are acutely aware of this. One area that has gained C-level attention in recent years is ensuring the security around OT infrastructure. Whereas two decades ago, boardroom discussions revolved around the security of IT operations, attention has shifted to OT operations because of newly formed attack surfaces and attack vectors. These include the rapid adoption of new technologies such as IT/OT convergence and industrial IoT devices, as well as new threat actors such as malicious (or negligent) insiders or nation-state attacks.

Gaining the upper hand on industrial cyber risk

Despite the increased focus on securing OT environments, critical organizations are still looking for a better approach when it comes to industrial cybersecurity. Fortunately, there are a few steps that every organization can take to reduce risk across their critical infrastructure. 

1. Secure the brains of your industrial operations.

PLCs are central to the operation of OT environments. These devices control the pumps and motors and robots that power massive utility and manufacturing plants. Regular programming changes to the PLC may be normal, but they can also result from a programming error or malware that affected an unauthorized change. Automatic “snapshotting” of configuration changes maintains a “last known good state” of your control systems and preserves an audit trail of any changes that are made. Recording this activity, at specific intervals or any time users make a change, is an essential first step in reducing risk around your most critical infrastructure assets.

2. Gain full visibility across your OT Infrastructure.

Siloed organizations that separately deploy IT and OT security leave critical blindspots in their wake. With security incidents such as Lockergoga, attacks are now architected to infect and propagate across the converged IT/OT infrastructure. While most organizations have some visibility into their IT footprint, it is also essential to have a full inventory of OT assets in your environment. 

Unlike IT devices which often have a lifespan of 36 months, OT devices can maintain a lifespan of decades. Over that period of time, teams often change, maintenance may become lax and in almost all cases meticulous documentation of things like patches and firmware updates are missed. By deploying industrial-grade security that can view your entire organization’s infrastructure, along with asset inventory down to ladder logic and backplane information, you can eliminate the risk of not knowing the full range of assets you need to protect. 

3. Use multiple detection methodologies to identify threats early.

Gaining deep situational awareness of each asset in your environment is crucial to protecting common infiltration points and targets of cyberattacks. It’s equally important to remain vigilant about what is traversing your network, keeping in mind that network traffic and behavior are early warning signs for attacks and attack propagation. Reducing attack risk requires multi-detection capabilities which include policy, anomaly and signature-based detection. Using multiple detection methods can prevent both known and zero-day attacks, while also leveraging the power of the security community to find more threats and thus secure the environment from more attacks earlier.

4. Focus remediation efforts on critical assets and actual exploits.

Whichever OT vendors are present in your infrastructure, chances are you’ll see many vulnerabilities announced over their product lifetimes. In fact, critical infrastructure organizations often operate with hundreds of thousands of vulnerabilities at any given time! It can be unmanageable and impractical to track and remedy all of those vulnerabilities with new ones being announced every day. 

The good news is you don’t have to. Risk is primarily associated with vulnerabilities that become exploits. Once you have a detailed understanding of the specific vendors, model numbers, patch levels and firmware versions inside your OT environment, you can utilize functionality that identifies the vulnerabilities and exploits most relevant to your environment. With a prioritized list of vulnerabilities, based on asset criticality and type of exploit, you’ll be able to triage your response and reduce the highest-risk elements first to keep your environment secure. 

More information on protecting OT environments

Critical Infrastructure will likely continue to widen in scope and additional demands may be placed on these organizations to produce to specific requirements. Continuously re-evaluating risk helps identify areas for improvement. Deploying the right security tools, built for OT environments but easily integrated with existing IT security, can help ensure the rock-solid dependability of the organizations that comprise our critical infrastructure.

For more information on how to upgrade your OT security posture, here are some resources that can help: 

• Watch the on-demand webinar, “5 Things You Need to Know About IT/OT Convergence”
• Check out the infographic on “The 7 Most Unsafe Gaps for Industrial Cybersecurity”
• Read our whitepaper on “Critical Infrastructure Cybersecurity” and how to actively secure your industrial environment in the new era of distrust.

Cisco releases a bundled publication to address 12 vulnerabilities across Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), including a critical path traversal vulnerability.

Update 05/09/20: This blog has been updated to remove references about Firepower Management Center (FMC) software, as Cisco have confirmed that it is not affected.

Background

On May 6, Cisco released security advisories for 34 vulnerabilities, including 12 vulnerabilities rated as “High,” in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) as part of a bundled publication.

Analysis

The 12 vulnerabilities in the bundled publication include the following:

While the majority of the vulnerabilities in this publication are denial of service, the path traversal vulnerability appears to be the most notable, with a CVSSv3 score of 9.1.

CVE-2020-3187 is a path traversal vulnerability that surfaces in the web services of Cisco’s Adaptive Security Appliance and Firepower Threat Defense software when the WebVPN or AnyConnect feature is configured. According to Cisco, this flaw exists when processing URLs that are not properly validated. A remote, unauthenticated attacker could send a specially crafted HTTP request using “directory traversal character sequences” to the affected device, allowing the attacker to read or delete sensitive files from the web services file system. The advisory from Cisco notes that any ASA or FTD device with a vulnerable AnyConnect or WebVPN configuration is affected. The following tables show the ASA or FTD feature and the associated vulnerable configuration displayed when using the 'show running-config' command via the command-line interface:

Source:Cisco CVE-2020-3187 Advisory

Source:Cisco CVE-2020-3187 Advisory

Reading sensitive files is limited in scope

This vulnerability evokes memories of recent vulnerabilities in SSL VPNs like Pulse Connect Secure, FortiGate, and Citrix ADC. While they might seem similar in nature, it does not appear that this vulnerability has the same level of exposure. According to Cisco’s advisory, an attacker can only read and delete files “within the web services file system” and the exposure “does not apply to the ASA and FTD system files or underlying operating system (OS) files.” The type of files exposed in the web services file system include:

• WebVPN configuration
• Bookmarks
• Web cookies
• Partial web content
• HTTP URLs

Deleted files are recoverable

Cisco’s advisory also notes that, even if an attacker were to delete files from the web services file system, the files would be restored once the device has been reloaded.

Proof of concept

At the time this blog post was published, there were no proofs-of-concept available for any of the advisories Cisco released.

Solution

Cisco has released software fixes for most of these vulnerabilities. However, not all of the advisories appear to have released complete fixes. We recommend referring to the individual Cisco advisories or contacting the Cisco Technical Assistance Center (TAC) for information on solutions.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Cisco Advisories for May 6, 2020
• Cisco May 2020 ASA and FTD Software Security Advisory Bundled Publication

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

How does Tenable’s VPR score help users manage newly disclosed vulnerabilities, even before they’re published on the National Vulnerability Database (NVD)? Let’s find out.

In April, we published a blog on how vulnerability priority rating (VPR) was used to help prioritize the most dangerous CVEs in 2019. Many of the vulnerabilities covered in that post were old but newer vulnerabilities shouldn’t be neglected. Our research shows that many vulnerabilities are targeted by threat actors shortly after public disclosure. In the case of zero-days, they’re targeted even before the public is notified. This blog will discuss how VPR can be used to prioritize vulnerabilities prior to publication on the National Vulnerability Database (NVD).

From Vulnerability to NVD CVE

The NVD is a vulnerability repository consisting of databases implementing aspects of Security Content Automation Protocol (SCAP), such as: Common Vulnerabilities and Exposures (CVE); Common Platform Enumeration (CPE); Common Configuration Enumeration (CCE); and Common Vulnerability Scoring System (CVSS). It is a primary source of vulnerability information for cybersecurity practitioners and researchers. 

The screenshot in Figure 1 shows a typical CVE entry page displaying the CVE ID, a short description of vulnerability impact and external references, often provided by CVE Numbering Authorities (CNA). Other information can include CVSS metrics (v2 and v3), Common Weakness Enumeration (CWE) and affected product configurations as CPE. 

Figure 1. Screenshot of NVD page

Normally, the CNA would assign a CVE ID to the vulnerability on its discovery. Subsequently, the CNA would start to prepare information for publishing it to NVD — impact analysis, description of the vulnerability, assign a CVSS vector, and so forth. The completed CVE entry is sent to the MITRE CVE team to be published on NVD. In parallel, the vulnerability may already be disclosed on CNA’s security advisory board.

What is a pre-NVD gap?

As a result of the process outlined above, the CVE publication workflow may result in a delay between the initial public disclosure of a vulnerability and its publication on NVD. NVD acknowledges the existence of such a lag and points out that:

The "Date Entry Created" date in a CVE Entry indicates when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Entry published on the CVE List. This date does not indicate when the vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.

In the remainder of this blog post we refer to the time gap between the public disclosure of a vulnerability and its publication on NVD as a pre-NVD gap. Let’s use CVE-2019-17026 as an example to get a more concrete idea of a pre-NVD gap:

• CVE-2019-17026 was first reported in the Mozilla Security Advisory on Jan 8, 2020
• It was then published to NVD on March 2, 2020
• Two days later, on March 4, 2020, it received CVSS metrics

In this example the pre-NVD gap of CVE-2019-17026 is from Jan 8 to March 2 – a 55-day pre-NVD gap. 

Many CVEs experienced big pre-NVD gaps in recent years

Having a pre-NVD gap is not rare for CVEs – 71,000 CVEs are first disclosed in vendor security advisories prior to publication on the NVD, accounting for half of all CVEs. In 2019, 5,300 CVEs had a pre-NVD gap.

Figure 2. Annual number of pre-NVD CVEs broken out by pre-NVD gap size since 2006

While the pre-NVD gap of some CVEs falls in an acceptable range of one day, our research shows that this gap is much larger for many other vulnerabilities. Figure 2 shows the annual number of pre-NVD CVEs since 2006, broken out by the gap size. Note that the term pre-NVD CVE is used in this blog to refer to CVEs that have been pre-NVD at some point in their lifecycle (and may still be).

This chart tells us several things: 

• The annual number of pre-NVD CVEs has stabilized at around 5,000 since 2013. There was a surge in 2017 leading to the highest annual number of pre-NVD CVE that year at 8,100. Since then, this number has dropped to 5,200 in 2019. This shows that CNAs are becoming more agile in publishing CVEs in recent years.
• The distribution of pre-NVD gap size has become more polarized in recent years. Almost half of the annual pre-NVD CVEs were published on NVD within seven days of their initial disclosure, while a significant proportion took at least 30 days to be published. As cybersecurity practitioners, we need to pay attention to CVEs with a large pre-NVD gap as they can have a detrimental impact on your cyber exposure.

Threat activity prior to NVD publication

Of course, attackers do not wait until a CVE has been published on NVD before they start targeting it for exploitation. If we cross-reference our threat intelligence data with pre-NVD CVEs, we find that 5,400 out of 43,000 CVEs (12%) published between 2017 and 2019 were associated with threat activity prior to NVD publication.

Figure 3 shows a breakdown of these CVEs by publication year and pre-NVD threat window (i.e. days between the first known threat and its publication on NVD). A large proportion of these CVEs were under threat at least 30 days before NVD publication. As a consequence, any systems impacted by these vulnerabilities will be left exposed to threats before vulnerability information has been made available on NVD. 

Figure 3. Number of CVEs with pre-NVD threats since 2017, broken out by pre-NVD threat gap

How to prioritize pre-NVD vulnerabilities for remediation using VPR

It is never too early to remediate vulnerabilities under threat. The previous sections show that NVD is not the most responsive source of information for proactively managing vulnerabilities. Tenable addresses this issue by consuming vulnerability data directly from security advisories for 100+ major vendors, and this number is still increasing.

Extending VPR to scoring pre-NVD vulnerabilities is non-trivial. As discussed in the first part of this blog series, VPR is composed of two major parts: impact and threat. Because many CNAs do not provide CVSS metrics to a vulnerability at its pre-NVD stage, the impact score is not always available to VPR. As a result, VPR combines machine learning with natural language processing (NLP) methods to predict CVSS impact metrics from the raw text descriptions of CVEs. This approach will be discussed in more detail in a future blog post. 

In August 2019, Tenable announced that pre-NVD vulnerabilities were now being scored by the VPR model. In total, 12,073 vulnerabilities have been published since August 2019 and 1,592 were pre-NVD at some point following public disclosure. Figure 4 compares the VPR gap, i.e. the time between when a CVE was publicly disclosed and a VPR was assigned, with the pre-NVD gap. VPR is, in general, more responsive than NVD on scoring new vulnerabilities. For example: 

• All 1,592 vulnerabilities received a VPR score prior to NVD publication
• 84% of the pre-NVD vulnerabilities were scored by VPR within 24 hours, compared to 38% for NVD
• 499 vulnerabilities took more than seven days to get published on NVD, while only 101 vulnerabilities took more than seven days to receive a VPR score
• 245 vulnerabilities took more than 30 days to get published on NVD

The number of vulnerabilities with a VPR gap will reduce further as Tenable keeps consuming vulnerabilities from more vendors security advisories. 

Figure 4. Compare VPR publication gap with pre-NVD gap, broken out by gap size

Figure 5 shows the distribution of VPR scores assigned to the 1,592 pre-NVD CVEs during their pre-NVD stage. We see that 98 are rated as VPR Critical, 83 of which were associated with pre-NVD threats. This means VPR gives organizations the opportunity to reduce their attack surface by remediating newly disclosed vulnerabilities that are being targeted in the wild. The proportion of vulnerabilities associated with pre-NVD threats increases in line with the VPR criticality levels — 85% of the VPR Critical vulnerabilities are related to pre-NVD threats, 50% to VPR High and 25% to VPR Medium. This is in line with what was covered in the first part of this blog series. 

Figure 5. VPR score distribution for the 1,592 vulnerabilities in the pre-NVD stage

Case Study: CVE-2019-17026

This section uses CVE-2019-17026 as an example to illustrate how VPR can be leveraged for pre-NVD vulnerabilities. Let’s look at the event timeline:

• January 8, 2020: CVE-2019-17026 was first published on Mozilla Security Advisory. In the same security advisory, Mozilla announced it was aware of this vulnerability being exploited in the wild. Tenable published an analysis of this vulnerability following disclosure. On the same day, Tenable published plugins 132714 and 132715 to detect the affected Firefox vulnerability on Windows and plugins 132712 and 132713 for MacOS X. They were published with a VPR score of 9.7 due to the fact that the vulnerability has been leveraged in targeted attacks. 
• January 8 to March 1, 2020: The level of threat increased during the pre-NVD phase of this vulnerability. Multiple discussions and research of the exploitation of this vulnerability were observed across various sources, including Twitter, underground forums, Dark Web sites and technical blogs. This drove the VPR score up to 9.9 at its highest peak prior to NVD publication.
• March 2, 2020: CVE-2019-17026 was published on NVD and two days later it was analyzed resulting in a CVSSv3 score 8.8. 
• March 3, 2020 and after: The threat to this vulnerability remains high since its publication on NVD. More threat events have been detected on various sources, including mainstream media, Twitter, Dark Web sites, Paste sites and so on. In April, it was disclosed that this vulnerability has been exploited by an advanced persistent threat (APT) named DarkHotel, targeting China and Japan. The VPR for this vulnerability remains Critical at the time of publication.

Key Takeaways

In this blog, we have shown that it is not uncommon for a vulnerability to be targeted by threat actors prior to publication on NVD. Given the publication delays that can occur, security practitioners need to be cautious about using NVD as a single source of truth for vulnerability information. We showed that VPR rates new vulnerabilities in a timely manner – 84% of new vulnerabilities are scored by VPR within one day of public disclosure and 93% are scored within the first week. We also demonstrated how VPR can be leveraged to reduce the attack surface by remediating pre-NVD vulnerabilities under active exploitation.

Acknowledgments

Special thanks are extended to Bryan Doyle, data scientist manager, Kevin Flynn, senior product marketing manager, Susan Nunziata, senior director of editorial and content, and Matthew King, marketing manager, for reviewing this blog and contributing many great ideas.

Get more information

• Start your free trial now to see VPR in action – available in Tenable.io (in the cloud) and Tenable.sc (on-premises)
• Learn more about Tenable Predictive Prioritization and VPR

Learn more about the key threat vectors you will need to combat with vulnerability assessment tools and cybersecurity best practices.

The modern cybersecurity landscape is incredibly complex by any standard. Whether or not you are a cybersecurity professional, everyone can benefit from learning about the dangers you're most likely to face — and determine how security tactics like vulnerability assessment can help protect you. 

Sizing up the most common cyberthreats 

The damage done by common cyberattacks is often measured in loss of personally identifiable information and other valuable data. According to the Identity Theft Resource Center (ITRC), the vast majority of data breaches in the U.S. during 2019 — 1,115 out of 1,473 — stemmed from hacking, intrusion or unauthorized access, exposing more than 157 million sensitive records.¹ That said, the loss of PII is just one adverse consequence of an attack. There's also the interruption of business to consider, as well as damage to the network and IT infrastructure — both of which can seriously hurt your organization's financial bottom line.

The hacks noted above were the product of numerous threat vectors; some fairly common, others obscure. While it can't hurt to know them all, it's much more urgent that you know five of the most common cyberattack types² and what they entail: 

• Malware: This catch-all term encompasses a number of different cybersecurity threats, including everything from viruses and worms to banking trojans, adware, spyware and ransomware. Once these programs gain access to a targeted system, they can steal, destroy, encrypt or corrupt valuable databases, files and applications. 

• Phishing/social engineering: We've all received emails that might look normal at first but have one or more suspicious details, urging us to click on a URL or download a file. Often used to steal login details and the confidential info those credentials protect, phishing scams are also used as delivery systems for malware or other exploits, and they can be deployed via email, phone or SMS.

• Man-in-the-middle attacks (MitM): These entail intrusions upon two-party transactions — e.g., between an individual and their bank — intended to steal data shared between the two. MITM attacks may be especially dangerous for organizations that have employees who work remotely on public Wi-Fi (at a coffee shop or library), as they can only be carried out over unsecured networks or if one party's device is already compromised. 

• Denial of service (DoS): Hackers overwhelm servers or networks with frivolous traffic to render IT infrastructure useless in denial-of-service attacks, often to force the victim to pay a ransom. DoS campaigns can originate from one computer and internet connection or many; the latter are distributed DoS attacks, often coordinated by botnets.³ Botnet-driven DoS attacks can simultaneously cripple dozens of organizations across multiple continents, as seen in the infamous Mirai and WannaCry attacks. 
  
  
• Structured Query Language injection: SQL remains the most common method by which essential communications in a relational database occur.⁴ The injection of malicious code puts a database at the mercy of an unauthorized user, who can then steal any business-critical information within it.

Aside from those above, there are certainly other cyberattack types worth worrying about: rootkits that are subtly implanted to steal or corrupt data, formjacking of payment details,⁵ cross-site scripting (a cousin to SQL injection) and more. But the five bulleted exploit classes should absolutely be at the top of any organization's threat list. Additionally, new threats are always emerging, so another group of attack types could become more common in the not-too-distant future.

Evaluating cyberthreats by industry (and risk level)

Healthcare and finance appear to face the most danger from malicious online actors, albeit in different ways. According to the ITRC, healthcare organizations experienced 525 breaches during 2019, but didn't see significant loss of PII — likely because attackers were more interested in disrupting operations to elicit ransom payments. Banking and finance had the fourth-fewest breach incidents (108), but saw almost 101 million sensitive records exposed, far more than any other sector. 

Different sectors are also more at risk of certain attack types. Ransomware attackers have been laser-focused on healthcare organizations due to the wealth of data in their systems. Such attacks rose by 350% in that last quarter of 2019.⁶ As such, a hospital would do well to focus on phishing-based ransomware deployment. 

For similar reasons, state and local governments find themselves targeted with ransomware almost as often, as high-profile incidents throughout 2019 in Florida, Maryland, Georgia and Texas demonstrate.⁷ (Texas saw 23 municipalities simultaneously ransomed.⁸)

In terms of specific threats, a bank, for example, should probably be most concerned about the various classes of ATM malware (two dozen or more⁹).

It's also important to consider which attack types do the most damage, regardless of industry. Any self-propagating attack, such as the Emotet banking trojan, is extremely dangerous because of how it actively resists efforts to eradicate it. The botnets that have succeeded Mirai, meanwhile, are extremely dangerous because of how fast they spread among IoT-connected devices.

Options for protection

It's critical to protect yourself from all cyberthreats, even those that may not threaten your organization as directly as others. Even a DoS attack that halts operations for a brief time (even as little as 15 or 20 minutes) can substantially hurt an organization, especially a small- or medium-sized business.

You must leverage strong cybersecurity measures, including penetration testing and threat modeling. These can determine exactly where your organization's weak spots are, the specific urgency of these weaknesses and how attacks might play out in real time. Using such tactics within a comprehensive, continuous vulnerability assessment program is critical to your chances of success, especially considering that vulnerabilities can be broadly exploitable if they're known to attackers for barely a day or more.

Start discovering your vulnerabilities today with a free 7-day trial of Nessus Professional. With more than 100 new plugins released each week, Nessus helps provide timely protection from the latest threats.

Start Your Free Trial

_{1. ITRC, "2019 End-of-Year Data Breach Report," January 2020
2. HP, "What Are the Most Common Types of Cyberattacks?," May 2019
3. Webopedia, "DDoS Attack - Distributed Denial of Service"
4. InfoWorld, "What is SQL? The first language of data analysis," November 2019
5. Symantec, "Internet Security Threat Report," February 2019
6. Corvus, "Security Report: Healthcare - Hospitals, Providers and More," February 2020
7. National Law Review, "State And Local Governments Continue To Be Favorite Targets Of Cyberattacks," September 2019
8. CNBC, "Alarm in Texas as 23 towns hit by ‘coordinated’ ransomware attack," August 2019
9. Kaspersky, "Cyberthreats to financial institutions 2019: overview and predictions," November 2018}

The latest study from MeriTalk finds increased technical collaboration across federal agencies and industry stakeholders, as well as some worrying gaps in cybersecurity fundamentals.

Tenable recently co-sponsored a MeriTalk study conducted to assess the Department of Homeland Security’s Continuous Diagnostics and Mitigation (CDM) program, the initiative that provides cybersecurity tools and guidance to all federal agencies. MeriTalk surveyed over 100 federal and industry CDM stakeholders to capture their thinking about the state of the program and recommendations for its future direction. In reviewing the report, titled “CDM: The Next Chapter,” we came away with a mixture of excitement and trepidation.

It is exciting, for example, that a solid majority of respondents (59%) report that federal agencies are implementing CDM tools as part of an integrated cyber defense strategy (rather than a stand-alone program). Less exciting is the fact that 90% of respondents see adversaries as gaining the upper hand, and 68% find that CDM is not adapting fast enough to protect expanding cloud and mobile environments. Below we take a deeper look into some key “takeaways” not readily apparent from the report’s headlines.

Good news: Cross-agency teamwork is happening at many levels

Since its inception, CDM has been about teamwork. Designed as a groundbreaking effort to bring all federal agencies together to fight a common fight, CDM continues to invoke a team ethos not only among federal agencies, but also between federal and industry participants, and among different cybersecurity programs. Examples include:

• New shared services: From “Security Operations Center (SOC) as a Service” to the Cybersecurity and Infrastructure Security Agency’s recently approved QSMO marketplace, responses made clear that the federal enterprise is moving rapidly toward a “circle the wagons” approach that recognizes a shared need to defend against common enemies.
• Moving toward automation: Respondents overwhelmingly (82%) recognized the importance of integrating Trusted Internet Connections (TIC) 3.0 into CDM, with automated TIC data feeds supporting CDM reporting. 97% saw benefits in leveraging automation in general.
• Integration from both sides: Federal respondents pointed to integrating cyber initiatives as a top priority; industry stakeholders emphasized the need for federal guidance, with “improving integration” following closely behind.

It appears from the MeriTalk report that CDM stakeholders are in agreement that cybersecurity is truly a team sport. And with promising initiatives on the horizon, such as CISA’s centralized marketplace, it seems highly likely that the teamwork trend will continue to accelerate in CDM’s next chapter.

Not-so-good news: Too many teams are forgetting the asset management fundamentals

Speaking of sports, it is a long-accepted truth that building on solid fundamentals is an essential path to success in athletic competition. The same could be said for cybersecurity. One slide in the “Next Chapter” presentation gave us particular concern on that front. In a poll of federal-only respondents, 33% felt that they could only “somewhat” answer that most basic CDM question: “What is on the network?” Conversely, only 17% felt that they had complete, real-time visibility into the assets on their network environment.

Answers to the other core CDM “capability” questions revealed slightly better results. All areas left room for improvement, but this fundamental gap in asset management proficiency is a warning flag that must not be ignored. If you don’t know which assets are on your network, it follows that you don’t know what your vulnerabilities are. That cyber exposure gap needs to be closed before a secure expansion effort can proceed.

Back in the spring of 2017, the deployment of CDM tools revealed a 44% undercount in devices attached to the network. This cyber exposure chasm of “shadow IT” caused a major re-calibration of the scope of work required to achieve CDM goals. The fact that one-third of federal respondents in this latest survey feel unable to fully answer the “what is on the network” questions seems to indicate that, in spite of the tremendous progress of CDM over the past three years in closing the gap, there is still much work to be done.

How federal agencies can excel beyond the cybersecurity basics

Indeed, “gap-fill” requests continue to stream in from federal agencies. CDM’s ability to quickly deploy the necessary tools to fill those gaps will determine the rate at which planned expansion into cloud and mobile environments can proceed. At Tenable, we are committed to helping CDM close these cyber exposure gaps. Tenable.sc Continuous View is the vulnerability management platform that enables federal agencies to discover all assets in their network environment and identify the vulnerabilities in those devices. Deploying active Nessus scanners, passive “always on” Nessus Network Monitors, and Nessus agents can achieve complete visibility in today’s increasingly remote network environment.

Another exciting development in Tenable.sc is its Predictive Prioritization capability. Once gap-fill efforts disclose new vulnerabilities, the need to prioritize effectively, and to focus on those that truly pose threats, becomes paramount. Using legacy methods like CVSS as the basis for this prioritization will quickly lead to “vulnerability overload.” Last year, over 30% of the 17,000+ new vulnerabilities carried a CVSS score in the “high” or “critical” range. But past experience has shown definitively that the vast majority of those vulnerabilities pose no serious threat.

Predictive Prioritization is a data science-based process that goes beyond CVSS and re-prioritizes each vulnerability based on the likelihood it will be leveraged in a cyberattack. Predictive Prioritization assigns a Vulnerability Priority Rating (VPR) to every vulnerability – including those that have yet to be published in the U.S. National Vulnerability Database (NVD) – and updates the ratings daily based on threat intelligence, exploit activity and multiple other data inputs.

The Tenable data science team estimates that, on average, only 3% of vulnerabilities are actually exploited. Putting this into perspective, if you used VPR for prioritization, you would only need to patch about 500 of those 17,300 new vulnerabilities to eliminate all critical threats that posed a risk of exploitation. This is far more feasible than guessing which of the 5,300 critical or high CVSS vulnerabilities matter. 

By using VPR, and other capabilities that enable a risk-based approach to vulnerability management, agencies can immediately operationalize the objective of the new CDM dashboard ecosystem– assembling the tools and information that “allow agencies to ‘fix the worst problems first' across their networks.”

Join us on June 9th for CDM Central

The virtual CDM Central conference, "Tales From the Frontlines," will be streaming live on June 9. We’ll be there along with MeriTalk and federal IT leaders addressing the current state of the CDM program, and what’s in store for the program’s chapters ahead. Visit us at our virtual booth where we can interact through virtual chat features, live demos, and more. You can register here.

Get more information

• Visit our Remote Workforce resource page for access to our latest research findings and vulnerability advisories.
• Read our solution overview to learn more about risk-based vulnerability management.
• Download our CDM data sheet to see how Tenable helps federal agencies stay ahead of key cyberthreats.

Industrial cybersecurity not only pays for itself through cost savings and avoided breaches — it also improves operational resiliency at a time of increased cyberattack activity.

As organizations tighten their belts amid the ongoing pandemic response, there is renewed urgency in measuring the value of every dollar invested. This includes heightened scrutiny around return on investment (ROI), a factor that can often delay the actual purchase of a product even after the technical winner has been identified. In the current operating environment, leadership teams must answer the ROI question even for solutions that might seem essential – like industrial cybersecurity. 

For critical infrastructure and manufacturing organizations, the cyber threat looms larger every year. The operational technology (OT) underlying modern plants and factories is no longer “air-gapped.” As IT and OT networks converge, organizations must expand their security posture from traditional IT security to include solutions purpose-built for OT environments.

But, the ROI of industrial cybersecurity extends far beyond its role as a necessary line of defense. By assembling greater insights into and control over your OT infrastructure, organizations can realize improved operational efficiencies without introducing new attack vectors. Here are some specific considerations to keep in mind when building a case for your next OT security investment:

Cybersecurity pennies prevent multimillion-dollar breaches

There is no question that purchasing an OT security solution involves a capital outlay. Nevertheless, this sticker price is a fraction of the cost that a breach can incur without proper industrial safeguards in place. One day of unplanned downtime can cost upwards of $10 million for factory operators. And this doesn’t even include the costs associated with shaken shareholder confidence and long-term damage to the brand. 

Integrations unlock greater value from existing IT investments

Any worthwhile OT security solution should integrate with the IT security tools already deployed across your enterprise environment. This is critical to achieving a unified security layer that spans both IT and OT operations. Robust integration capabilities also increase the value of your previous security investments, by adding industrial visibility to next-generation firewalls (NGFWs), security information and event management (SIEM) solutions and unidirectional gateways. 

Rich asset knowledge reduces the cost of ongoing maintenance

A key function of industrial cybersecurity is the ability to see the entirety of your OT environment, including deep situational awareness of every asset down to the ladder logic. By gathering intimate knowledge of every asset’s cyber health, you can monitor and proactively schedule key maintenance, and reduce the frequency of “run to failure” scenarios. Most importantly, you’ll expedite your ability to identify and resolve misconfigured or malfunctioning devices, which means faster recoveries from unplanned downtime. 

Controlling your industrial cyber risk may lower insurance premiums 

Organizations are increasingly buying insurance policies with cybersecurity riders. But, before these riders are granted, insurance companies must perform a risk assessment, a test that is getting harder to pass with heightened security concerns around remote work and scaled-down workforces. Deploying a comprehensive OT security solution shows that your organization is compliant with cyber hygiene best practices, which can translate to a lower risk score and more favorable insurance terms. The cost savings from a favorable assessment recur every year while also reducing your organization’s cyber exposure gap.

Slowdown periods are a perfect time to upgrade your OT security

In response to current public health precautions, many organizations are experiencing a reduced production schedule. The fact that skeleton crews are helming critical OT operations only exacerbates the probability of a successful attack or accidental security incident, as cybercriminals pounce on the disruption to launch new malware and phishing attacks.

This slowdown period presents an opportune window for industrial organizations to upgrade their OT security. Not only will this move protect against heightened cyberthreats – it also avoids the prospect of necessary downtime in the future when implementing a new solution would require taking down an operation in full production mode. 

There’s no question that industrial cybersecurity ensures the long-term viability of critical infrastructure and manufacturing facilities, which require flawless operation and maximum uptime. Taking into account the five ROI considerations outlined above, it’s easy to see that procuring, deploying and operating an OT security solution ultimately saves the organization from dangerous exposure and astronomical costs related to a breach. 

The initial investment today quickly pays for itself, and allows industrial organizations to embrace digital transformation with confidence.

IP-in-IP packet processing, a protocol used for tunneling by numerous vendors, contains a vulnerability that may lead to DDoS, information leakage and bypass of network access controls.

Background

On June 2, the CERT Coordination Center (CERT/CC) released vulnerability note VU#636397 detailing an unauthenticated vulnerability in the IP encapsulation within IP (IP-in-IP) protocol. The original disclosure is credited to Yannay Livneh, a cybersecurity researcher on the Enigmatos team.

How IP-in-IP protocols work

The IP-in-IP protocol, outlined in RFC2003, provides a mechanism to encapsulate one IP datagram within another IP datagram for tunneling, which allows for communication between two IP networks that do not have a native routing path. This process includes both an inner and outer IP header. The inner header, which contains the original Source Address of the sender and Destination Address of the recipient, remains unchanged throughout the journey with the exception of a decremented time to live (TTL). The outer IP header identifies the endpoints of the tunnel using the Source Address and the Destination Address. These encapsulated datagrams are decapsulated at an intermediate destination node to reveal the original IP datagram before being sent to the Destination Address highlighted in the inner IP header. The use of IP-in-IP encapsulation can be identified in packets that have an IP protocol header value of 4.

Analysis

CVE-2020-10136 is an IP-in-IP processing vulnerability that could allow an unauthenticated attacker to route traffic through exposed interfaces on vulnerable devices, which may result in a reflected distributed denial of service (DDoS), information leakage and the bypass of network access controls (NACs). The vulnerability exists due to an unexpected Data Processing Error, which may result in vulnerable devices not correctly inspecting and verifying forwarded packets that could have originated from a malicious source or been intended for a malicious destination. Yannay’s original disclosure included two scenarios in which his code could be used to exploit this vulnerability:

Scenario 1: Spoof Mode

In spoof mode, an attacker would send a crafted malicious IP-in-IP packet to VULNERABLE_MACHINE_IP, which would then replay a packet to a VICTIM_IP. As the VULNERABLE_MACHINE_IP is a valid trusted source, the packet would not be blocked by any anti-spoofing countermeasures. A scenario like this allows for packets to be sent en masse, demonstrating how a DDoS attack could be achieved.

Image Source: CERT/CC GitHub Repository

Scenario 2: Bypass Mode

In bypass mode, an attacker would send a crafted malicious IP-in-IP packet to a VULNERABLE_MACHINE_IP, which would decapsulate the packet and forward the inner IP packet to the VICTIM_IP with the source IP address of the DATA_COLLECT_IP. The attacker can use the VULNERABLE_MACHINE_IP as a forwarding point to gather information from the DATA_COLLECT_IP by having the VICTIM_IP send queries for enabled protocols, such as SNMP to DATA_COLLECT_IP.

Image Source: CERT/CC GitHub Repository

Proof of concept

The original proof of concept (PoC) created by Livneh has been added to the CERT/CC GitHub repository.

Solution

At the time this blog was published, CERT/CC has confirmed that the following four vendors are affected by this vulnerability:

• Hewlett Packard Enterprise
• Digi International
• Treck
• Cisco

Cisco released an advisory for CVE-2020-10136 on June 1 for NX-OS Software. A comprehensive list of affected vendors and their impacted product/versions can be found on the CERT/CC advisory with their respective statements. This list will continue to be updated by CERT/CC as the vendors respond. We recommend that the latest patches are applied to affected products as highlighted by the individual vendors’ responses.

If circumstances do not allow for the application of the advised patches, CERT/CC recommends that users disable IP-in-IP on any devices and interfaces where it is not required. If IP-in-IP must be enabled, packets using IP protocol 4 should be filtered. This does not mean filtering for IPv4 packets, but rather packets with an IP protocol header value of 4.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• CERT/CC IP-in-IP Advisory (VU#636397)
• Proof of Concept - CERT/CC GitHub Repository
• Cisco NX-OS Software Unexpected IP in IP Packet Processing Vulnerability Advisory
• RFC2003 IP-in-IP

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

IDC’s first-ever market share report for the worldwide device vulnerability management market ranks Tenable as #1 in market share for 2019 and credits the company for extending its reach far beyond vulnerability management.

IDC recently published their Worldwide Device Vulnerability Management Market Shares, 2019: Finding the Transitional Elements Between Device Assessment Scanning and Risk-Based Remediation (May 2020) report to highlight the most prominent VM providers in the world. The report ranks Tenable as #1 in market share and revenue for the past two years. 

IDC credits Tenable’s success to a number of key elements, including:

• The ability to deliver broad visibility across the modern attack surface, including IT, operational technology (OT) and cloud environments
• The expertise to help organizations quantify cyber risk, prioritize remediation decisions and benchmark against peers
• A research team that plays an integral part in supporting Tenable customers through threat intelligence, vulnerability detections and security alerts 

CVSS alone is failing you

While v3 of the Common Vulnerability Scoring System (CVSS) has certainly made some improvements over past versions, IDC acknowledges that it’s still problematic, stating that, “a CVSS score provides a one-dimensional representation of a multidimensional problem.” At Tenable, we couldn’t agree more. 

CVSS is risk-unaware. Since most CVSS scores are assigned within two weeks of vulnerability discovery, the score only employs a theoretical view of the risk a vulnerability could potentially introduce. That leads security teams to waste the majority of their time chasing after the wrong issues while missing many of the most critical vulnerabilities that pose the greatest risk to the business.

Instead, security teams must understand the full context of each vulnerability. In addition to the CVSS score, Tenable correlates and analyzes other essential contextual data, including threat and exploit intelligence, an assessment of asset criticality and continuous analysis of a 4.5 petabyte data lake that includes more than 20 trillion threat, vulnerability and asset data points. All of this data is processed using machine learning automation to render an accurate risk score for every vulnerability within seconds.

Armed with the full context of each vulnerability, security teams are able to take decisive action to reduce the greatest amount of business risk with the least amount of effort.

World-class research enables companies to predict the risks that matter most

In highlighting Tenable’s vast research capabilities, IDC acknowledges the crucial synergies of integrating technology with research to inform customer decisions. Tenable research certainly fulfills this need. According to the report, “Tenable has written over 141,000 plug-ins encompassing more than 56,000 CVE and 30,000 Bugtraq IDs. Tenable Research satisfies the criteria of 126 CIS Benchmarks.”

Tenable processes over 1.5 billion instances of vulnerabilities per week and analyzes exposure trends from more than 4.5 petabytes of data. Our machine learning algorithms predict which vulnerabilities are most likely to be exploited in the near future and assign Vulnerability Priority Ratings (VPR) and Asset Criticality Ratings (ACR) accordingly. The VPR is calculated based on what we can determine about the vulnerability itself, as well as what we see in the current threat environment. The ACR is a calculation of how important the asset is to the organization, so it’s highly customized to each customer. Predictive Prioritization is then applied to both ratings to help customers prioritize remediation efforts based on actual business risk, determine their cyber risk reduction over time and benchmark their level of cyber exposure against industry peers. 

Traditional IT assessments leave blind spots

In addition to traditional IT assets, the modern attack surface also includes OT, web apps, cloud and container environments, creating a cyber exposure gap that’s being exploited by attackers. All of these environments contain vulnerabilities, and adversaries routinely scan the entire attack surface to find the easiest way in. Yet, legacy vulnerability management methods are limited to scanning traditional IT environments, so cloud and OT assets — and the vulnerabilities that reside on them — remain invisible to the organization. 

IDC credits Tenable for extending its visibility far beyond traditional assets to include broad coverage and thorough assessments of an organization’s entire attack surface. By assessing modern assets as well as traditional on-premises IT environments, Tenable eliminates the blind spots that plague legacy tools and enables security teams to discover and assess all of their vulnerabilities in a unified platform. As a result, users can determine which vulnerabilities to prioritize for remediation based on the risk they pose to the organization — regardless of where they reside.

In addition, IDC points out that Tenable can secure and harden Docker and Kubernetes environments against CIS Benchmarks, and is integrated into CI/CD pipelines to quickly assess new container image builds for vulnerabilities and malware to prevent security issues from reaching production.

Comprehensive risk-based VM solution

Tenable helps customers evolve from legacy vulnerability management programs — which are interrupt-driven and error-prone — to a more proactive and strategic approach. Legacy VM is limited to discovering and assessing vulnerabilities. But Tenable solves the higher-order challenge of helping organizations effectively prioritize what matters most, calculate key metrics, compare their progress against industry standards and determine when and where to make adjustments to optimize their strategy. Clear reporting also enables teams to build and maintain management’s confidence in their capabilities and prevent panic mode when high-profile exploits occur.

To highlight the value of this comprehensive approach, IDC points to Tenable Lumin® which enables customers to calculate, communicate and compare their cyber risk. Lumin helps them understand vulnerabilities in the context of business risk and use that intelligence to prioritize the team’s efforts so they can focus first on the vulnerabilities and assets that matter most. In IDC’s words, “Lumin is used to establish an assessment of a company's overall security posture, industry benchmarking, and how a company's posture improves with certain remediation measures.”

Want to learn more? Download the IDC report excerpt now.

Read the Report Excerpt

In the first of our three-part series, Tenable Research unveils the key findings from our new report on common persistent vulnerabilities, including their likely causes and the importance of prioritization to effectively reduce cyber risk.

Why do some vulnerabilities persist longer than others? And how should that influence your remediation process? 

In its latest report, Tenable Research looks at the common persistent vulnerabilities that often linger on enterprise systems for months, even years. As the number of potential attack vectors multiplies each year, our findings show that many dangerous threats persist longer than they should, in large part because traditional remediation models are ineffective. 

The first of our three-part blog series provides an overview of the background, research methods and key findings behind this report.

The challenge: CVSS is risk-blind

The last few years have seen a staggering growth in the number of vulnerabilities disclosed. In 2019, over 17,000 vulnerabilities were added to the U.S. National Vulnerability Database (NVD). Given this large volume of vulnerabilities, remediating every one present on an organization’s systems is unsustainable. 

Security teams must prioritize vulnerabilities to ensure they are effectively reducing risk and not misapplying limited resources. However, they have largely been left to their own devices for prioritization. Many organizations have adopted the Common Vulnerability Scoring System (CVSS), a metric designed to describe the technical nature of vulnerabilities, to drive prioritization. But, the misinterpretation and misuse of CVSS only compounds the problem, as CERT researchers noted in their paper on the topic:

“CVSS is designed to identify the technical severity of a vulnerability. What people seem to want to know, instead, is the risk a vulnerability or flaw poses to them, or how quickly they should respond to a vulnerability.” ¹

This lack of prioritization exposes organizations to risk, as vulnerabilities go unremediated even as they are actively being exploited in the wild. 

Research methodology

To better understand the nature of this remediation gap, we sought answers to the following research questions: 

1. Causes of persistence: Do the characteristics of vulnerabilities affect their persistence? Or, is persistence merely related to the remediation process and its pace? 
2. Variance in remediation: Are there vulnerability remediation differences between organizations? And, are there differences within each organization?

Tenable has one of the most extensive vulnerability and intelligence datasets in the industry. It is derived from a 4.5-petabyte data lake of vulnerability data collected from over 10 different sources, including open-source and commercial intelligence feeds.

We analyzed Time to Remediate data and leveraged the interquartile range technique for outlier detection. The main goal was to understand what makes a vulnerability survive in the remediation race.

We only considered Time to Remediate data on vulnerabilities assessed within three months of their initial publication to NVD (i.e., vulnerabilities assessed from -1 to +3 months from their NVD publication date). This accounts for an average of a one-month delay for NVD publication.²

Key findings: Why prioritization beats the remediation race

Our analysis revealed many shortcomings in traditional remediation practices. Even as security teams work around the clock to defend their attack surface, if they are remediating threats based on CVSS data alone, there is no guarantee those efforts are effectively reducing their overall cyber risk. A few key stats that validate this conclusion: 

• Exploitable vulnerabilities often fly under the radar. Despite their higher risk, vulnerabilities with exploits show roughly the same persistence as those with no available exploit. Defenders are still operating as though all vulnerabilities have the same likelihood of exploitation.

• Client-side vulnerabilities are the most persistent threats. Over 60 percent of persistent client-side vulnerabilities have been exploited in the wild, compared to just 38 percent across the population at large. Vendors ought to make it easier for customers to fix their products, and security teams must prioritize difficult-to-upgrade software patches. 

• Few teams can afford to win the remediation race. Only 5.5 percent of organizations prevail in remediating more vulnerabilities than they discover during a given timeframe. This again points to the need for greater prioritization, as attaining 100-percent remediation is unsustainable for most organizations.

Security teams need data-driven tools that can help them work smarter and drive effective remediation. Predictive Prioritization combines proprietary Tenable-collected data with third-party threat intelligence to continually reassess vulnerabilities based on proper threat modeling. This approach, powered by an advanced data science algorithm developed by Tenable Research, enables organizations to focus on the small fraction – roughly three percent – of vulnerabilities that pose actual risk.

The best way for organizations to gain ground against cyberthreats is to change the remediation game altogether. In the next two installments of this series, we’ll dive into the data to look at the lifespan of vulnerabilities as well as remediation trends across the global population. If you’d like to get a head start, you can download the full report below.

Download the Free Report

_{1. CERT, "Towards Improving CVSS," December 2018
2. Recorded Future, "The Race Between Security Professionals and Adversaries," June 2017}

In the second of our three-part series on persistent vulnerabilities, Tenable Research examines survival data to assess how effectively traditional remediation tactics are combating the attacker's advantage. 

Last week, we unveiled a new report from Tenable Research which explores the issue of common persistent vulnerabilities. As security teams wrestle with the vulnerability overload problem, this research seeks answers to the following questions:

1. Do the characteristics of vulnerabilities affect their persistence? Or, is persistence merely related to the remediation process and its pace? 
2. Are there vulnerability remediation differences between organizations? And, are there differences within each organization?

Part 1 of our blog series detailed the motivation and methodology behind this research, as well as key findings around prioritization. In part 2, we analyze the data trends underlying vulnerability lifespans and the factors that determine the rates and effectiveness of traditional remediation efforts.

Most vulnerabilities are remediated within a year – the rest live on

We can examine persistence through multiple lenses. Let’s start by considering the overall lifespan of a vulnerability in an environment, from the first assessment to the last remediation. 

Figure 1 tracks change over time for all vulnerabilities that have been remediated at least once within an environment. We did not include instances of vulnerabilities that were never remediated, as these open vulnerabilities can skew the overall results. This survival data is based on the lifespan of a vulnerability within a given organization, not across the global population.

Figure 1. Vulnerability lifespan analysis – a per-organization view

We see that 73 percent of vulnerabilities are still extant within 30 days of the first assessment. After 120 days, close to 54 percent remain unremediated. Beyond that, 32 percent of those vulnerabilities still lurk after a year, and about 26 percent are never driven to zero. The vast majority of vulnerabilities over a year old are never dealt with. In fact, if a vulnerability gets past a year of its first assessment, it has less than a 20 percent chance of being remediated. The median lifespan of a vulnerability is 110 days.

As vulnerabilities age, the remediation pace slows. This may indicate a tradeoff with coverage (in favor of additional, newer vulnerabilities) or the presence of persistent vulnerabilities. The 32 percent of vulnerabilities that were not remediated after a year are still present in 90 percent of environments. This means only 10 percent of organizations have managed to address all their open vulnerabilities within a year of first assessment.

The above trend is not only related to remediation, but also a consequence of the time to assess. The median time to assess all instances of a given vulnerability across a single organization is 29 days, while the median time to remediate all those instances (in cases driven to zero) is 40 days. 

Exploitable vulnerabilities are widespread in early months, despite higher risk

These timelines show there are differences within each organization that contribute to the overall remediation challenge and the large percentage of unremediated vulnerabilities over time. In a previous study, we measured the difference in days between when an exploit for a vulnerability becomes publicly available (i.e. “Time to Exploit Availability”) and when that vulnerability is first assessed within an environment. The results showed a negative median of 7.3 days, indicating the attacker’s advantage. The additional intra-organization timelines presented here further increase that advantage.

As shown in Figure 2, the lifespan trend for exploitable vulnerabilities is almost the same as the trend for all vulnerabilities. In the first few months, exploitable vulnerabilities are even slightly more persistent than the overall population:

• After 30 days, 76 percent are still unpatched (vs 73 percent of non-exploitable vulnerabilities) 
• After 90 days, the delta narrows to 55 percent (vs 54 percent)

However, beyond this point, the rate drops more quickly and reaches 27 percent after a year. Roughly 18 percent of exploitable vulnerabilities are never driven to zero. 

Figure 2. Exploitable vulnerability lifespan analysis – a per-organization view

This data suggests that defenders are still operating under the classic assumption that attackers can exploit any vulnerability. Under traditional remediation tactics, higher-risk threats are not resolved any faster than other vulnerabilities. Because exploit code for most exploitable vulnerabilities is used within a few months of publication, additional threat intelligence and risk-based prioritization is necessary to correct this trend.

On the other hand, we’ve also looked at the difference between vulnerabilities unremediated for over a year and those remediated within the year. Among the roughly 400 vulnerabilities that haven’t been remediated at least once within the year, only a dozen are exploitable (see Figure 3). These persistent, high-risk vulnerabilities have a very low prevalence, found in at most four organizations (out of more than 2,600). These are extreme cases of localized persistence. 

Figure 3 includes three classes of exploit maturity:

• Proof-of-concept (PoC): Code is available on public websites and repositories (e.g., GitHub, Exploit-DB, Packet Storm)
• Functional: Exploit is ready to use within penetration testing and red-teaming frameworks (e.g., Canvas, Metasploit, Cobalt Strike)
• High: In-the-wild exploitation has been confirmed and attributed by antivirus vendors or other leading threat detection and intelligence solutions (e.g., ReversingLabs)

Figure 3. Exploitable vulnerabilities left unpatched for more than a year

After the one-year mark, the number of high-risk threats shrinks even further. A reverse lookup, across the entire population of organizations, into the exploitable vulnerabilities unpatched for over a year, reduces the set to only one vulnerability (CVE-2018-0492) in one organization. This confirms the localized aspect of these cases of persistence. It also shows that almost no exploitable vulnerabilities go unremediated for an extended period of time across the global population. We get a hint of an answer here to question one, suggesting that vulnerability characteristics would not play a role for these cases of localized persistence.

In the third and final part of this series, we’ll explore the persistence of exploitable vulnerabilities from a global, rather than a localized, perspective. We’ll analyze how vulnerabilities persist across all global assets, not just within a given organization. We’ll also look at the economic aspect of persistence and prevalence and ask, “To what degree must a vulnerability exist across the global user and asset population to make it a viable and attractive target for attackers?”

To learn more about our original research into common persistent vulnerabilities, you can download the full report today.