Cisco warns of two zero-day denial-of-service vulnerabilities in its IOS XR Software actively exploited in the wild.

Background

On August 29, 2020, Cisco published an advisory regarding a zero-day denial-of-service (DoS) vulnerability in its Cisco IOS XR Software. This advisory was released in response to the Cisco Product Security Incident Response Team (PSIRT) becoming “aware of attempted exploitation of these vulnerabilities in the wild” on August 28. Cisco updated its original advisory on August 31 to reflect an additional vulnerability in the IOS XR Software and include another CVE. The Cybersecurity and Infrastructure Security Agency (CISA) also issued an alert on August 31 regarding the attempted exploits in the wild, recommending that organizations apply mitigations or patches when available.

Analysis

CVE-2020-3566 and CVE-2020-3569 are unauthenticated DoS vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software, an operating system that comes installed on a range Cisco carrier-grade and data center routers. These vulnerabilities exist because the affected device is unable to correctly implement queue management for Internet Group Management Protocol (IGMP) packets.

A remote unauthenticated attacker that successfully exploits these vulnerabilities could exhaust the process memory on a vulnerable device, starving it of resources. For an attacker to take advantage of this flaw, they would need to send specially crafted IGMP packets to a vulnerable device. This could result in instability in processes including, but not limited to, an impact in the routing protocols for both internal and external networks which could result in the slowing or crippling of a network.

These vulnerabilities impact Cisco devices running any version of the Cisco IOS XR Software that also has multicast routing enabled on any of its interfaces. If multicast routing is not enabled on the device, then it is not affected by either of these vulnerabilities. Running the command show igmp interface on a device with Cisco IOS XR Software will show the multicast routing configuration. If the output is empty, the device is not affected. Below is an example output of a device with multicast routing enabled:

Source:Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability Advisory

Proof of concept

There was no proof-of-concept available for these vulnerabilities at the time this blog post was published.

Solution

All Cisco devices running any version of Cisco IOS XR Software with an active interface configured under multicast routing are affected by these vulnerabilities. At the time this blog post was published there were no patches or workarounds available, but we will update as Cisco releases patches that address these vulnerabilities

Cisco has recommended two mitigations to implement where appropriate for the environment of a vulnerable device. The first mitigation will not prevent exploitation but rather limits the rate of IGMP traffic to that lower than the current average rate, increasing the time required for successful exploitation. This mitigation can be implemented by entering the following command while in configuration mode:

RP/0/0/CPU0:router(config)# lpts pifib hardware police flow igmp rate

The second mitigation is to update an interface access control list (ACL) or create a new one with an access control entry that denies DVMRP traffic inbound on that interface. This mitigation can be implemented by entering the following command:

RP/0/0/CPU0:router(config)# ipv4 access-list deny igmp any any dvmrp

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability Advisory
• CISA Warning for DVMRP Vulnerability in IOS XR Software
• Cisco IOS XR Software

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

As organizations around the world raced to develop strategies to respond to the COVID-19 pandemic, an independent business risk study shows cybersecurity leaders were largely left out.

The way in which organizations plan for and manage business risk is among the many profound changes taking place as a result of the global COVID-19 pandemic. Yet, many cybersecurity leaders are still struggling to get a seat at the table. 

In fact, a study conducted by Forrester Consulting on behalf of Tenable reveals an alarming disconnect between business and cybersecurity leaders. Although nearly all respondents (96%) say their organizations have developed COVID-19 response strategies, 75% say that business and security efforts are only “somewhat” aligned, at best.

This is deeply concerning at a time when the sudden, widespread embrace of work-from-home models in response to the pandemic is unleashing a plethora of end-user devices upon corporate networks. Remote desktops, once a nice-to-have offering for a select group of workers, are now essential tools used by scores of employees to keep organizations running. Employees are suddenly connecting to core business systems and applications using their own previously untested — and potentially vulnerable — consumer routers and home networks. The popularity of internet-of-things (IoT) devices makes them potential threat vectors. The average home network could include an Amazon Alexa or other voice-activated tool, internet-connected TVs and video game devices, and assorted laptops, tablets and phones belonging to spouses, children or others in the household.

The Brookings Institute estimates that, as of April 9, 2020, up to half of American workers were working from home, which it calls “a massive shift.” Indeed, a Pew Research study shows that, prior to the pandemic, only 7% of civilian workers in the United States — roughly 9.8 million of the nation’s approximately 140 million civilian workers — had access to a “flexible workplace” benefit or telework option.

And cybercriminals are swooping in to take advantage of the exponentially expanding attack surface. According to the Forrester study, as of mid-April 2020, four in 10 organizations (41%) had already experienced at least one business-impacting* cyberattack as a result of a COVID-19-related phishing or malware scheme. The data, based on an online survey of more than 800 business and cybersecurity leaders in 10 countries, is drawn from the study, The Rise of the Business-Aligned Security Executive. 

COVID-related scams were the No. 1 source of all business-impacting cyberattacks reported in the study. Although the World Health Organization had only declared COVID-19 a pandemic a few weeks earlier, by the time the survey was conducted COVID-related attacks had already outpaced other business-impacting attacks such as fraud (40%), data breach (37%), ransomware (36%) and software vulnerability (34%).

On a personal level, I find the survey results oddly validating: They confirm I’m not the only security leader worried about these trends. Two out of three respondents to the Forrester survey (67%) say they are very or extremely concerned that the workforce changes necessitated by COVID-19 will increase their organization’s level of risk. 

Making matters worse, roughly half of the cybersecurity leaders (48%) surveyed say they have only moderate to no visibility into their remote, work-from-home employees.

One of the key ways to bridge this disconnect is for organizations to bring cybersecurity into the fold when developing risk management strategies. 

How risk management can help you become a business-aligned cybersecurity leader 

CISOs, CSOs and other cybersecurity leaders are uniquely suited to taking on a bigger role in risk management and the related disciplines of business continuity, disaster recovery and crisis management. Our work puts us squarely at the intersection of technology and business. We have visibility into all of the systems, data and processes required to deliver on a business continuity and disaster recovery plan. Being involved in risk management can also make your job a little more manageable: If you can understand all of your critical processes and assets from a broad enterprise risk perspective, it will only make you stronger in cybersecurity as well. 

There’s also a clear operational benefit to be gained from performing risk management exercises which can serve as a bridge between the business and the infosec sides of the organization. What is revealed in the process will help the entire organization understand how to best prioritize resources — both human and financial — to keep the business running even during a crisis.  

Sentara Healthcare: a case study in effective alignment

Sentara Healthcare offers a case study in effective alignment. In an interview with Tenable, Dan Bowden, CISO at Sentara Healthcare, noted that at the start of the pandemic, the organization’s IT and security teams found themselves charged with two crucial tasks: enabling a large number of employees to work from home; and helping to convert regular hospital rooms to serve as intensive care unit (ICU) rooms by switching out the operational technology (OT) and internet of things (IoT) systems needed to care for a sudden influx of critically ill patients.

“In March and April, I would say over 50% of our total work effort was dedicated to building ICU room capacity, and figuring out how [we can] use technology to reduce personal protective equipment (PPE) burn,” said Bowden.

While the transitions were ultimately successful, the organization’s patching process was thrown into a two-month disarray as a result.

“I'm a very aggressive vulnerability scanning CISO, and my team is [as well],” said Bowden. “We have a demand-based policy of what happens when we find a new vulnerability. And we had to tweak our vulnerability scanning timing and our patching policy a little bit because our IT teams were changing the beds in hospitals. A regular [hospital] room is configured a certain way from a technology perspective. And when you change that to an ICU room, there's a cascading change across a bunch of technology systems and applications that accompany that. Our infrastructure and application teams were very busy changing our surface of beds that we offered from a small number of ICU beds to a very large number of ICU beds. So we had to figure out how to continue complying with our patching schedule in a way that we could manage risk efficiently and effectively. We relied on Tenable's Vulnerability Priority Rating a lot for that. We probably used it much more aggressively this spring and summer than we have in the past.”

By June, the patching process was back on track. Now, as the fourth quarter approaches, Bowden is faced with significant budget decisions — as are so many industry sectors that experienced the economic impact of COVID-19. “We're trying to reduce [operating expenditures] and get back on budget. How do we make 2020 a break even year? We are very focused on basic lights on, doors open operations as well as any new requests that arise due to variations in COVID-19 spread.”

Bowden adds: “We have a very progressive leadership team that is saying to all of us ‘be creative, help us figure out how we grow in the midst of all this.’ So we've got a few big projects to tackle relative to that as well.” 

Showing return on cybersecurity investments

At a time when organizations worldwide are facing a potentially lengthy period of economic uncertainty, it becomes more critical than ever to prioritize investments based on risk. The Forrester study shows that when security and the business are aligned, they deliver notable results. For example, 85% of business-aligned security leaders have metrics to track cybersecurity ROI and impact on business performance versus just a quarter (25%) of their more reactive and siloed peers. The business-aligned security leader is also eight times as likely as their more siloed peers to be highly confident in their ability to report on their organization’s level of security or risk. And the vast majority (86%) have a process that clearly articulates expectations and demonstrates continuous process improvement, compared with just 32% of their more reactive and siloed peers. 

Getting involved in the development of your organization's Enterprise Risk Management (ERM) strategy will put you on the path to becoming a business-aligned cybersecurity leader.

These six steps will help with your initial enterprise risk identification and assessment:

1. Develop and distribute a risk assessment survey to key stakeholders. These are typically fielded to the senior director level and above and should include representatives from all of the major departments in your organization, including finance, legal, human resources, information technology, information security, sales, operations, marketing and R&D. Once your survey is complete, you’ll want to organize the responses into risk categories so you can compile an inventory of enterprise risks.
2. Conduct research and analysis to compare your organization’s enterprise risks to industry risk surveys.
3. Develop a risk assessment methodology, including probability and impact, to get a total risk rating. 
4. Identify key leaders in your organization and devote time to interviewing them to get their feedback on risks and prioritization as well as risk probability and impact.
5. Present your risk assessment results to executives to finalize the top risks and assign executive risk owners.
6. Work with executive risk owners to identify mitigation activities for the top risks.

Performing the above steps is a painstaking exercise that yields a high degree of benefit by giving you a clear set of priorities. You’ll have an agreed-upon list of enterprise risks. While cybersecurity is likely to be its own standalone enterprise risk, it will certainly impact many, if not all of the enterprise risks in some form. 

Couple the enterprise risk assessment with a business impact analysis— essential to business continuity and disaster recovery to determine which critical systems and business processes your organization can least afford to live without — and the two serve as the foundation for developing a business-aligned cybersecurity strategy. You’ll emerge with a list of your most critical enterprise risks and processes, making it equally possible to clearly prioritize responses in a time of crisis — regardless of whether the crisis results from a cyberattack, a natural disaster or a global pandemic — and when normal business operations resume. 

In stable times, it’s all too easy for organizations to treat enterprise risk management as a mere check-box exercise best left to a segregated team of risk professionals. With COVID-19, business and technology leaders have found themselves enrolled in a crisis management crash course. It’s up to each of us to take this as an opportunity to rethink our approach to enterprise risk so we’re better prepared for the down times and well positioned to benefit when things are going well. 

Previous blogs in this series focused on the challenges of aligning cybersecurity and business and why cybersecurity leaders struggle to answer the question “how secure, or at risk, are we?” Over the next several weeks, we’ll continue to explore findings from the Forrester study and provide guidance on how you can become a business-aligned leader. In our next installment, we’ll explore the technology, process, data and people challenges that are standing in your way. 

Learn more:

• See additional study highlights here
• Download the full study, The Rise of the Business-Aligned Security Executive
• Read the blogs, Aligning Cybersecurity and the Business: Nobody Said It Was Easy and Why Cybersecurity Leaders Struggle to Answer the Question ‘How Secure Are We?’
• Download the white paper, What It Takes to Be a Business-Aligned Cybersecurity Leader
• Read the eBook, How to Become a Business-Aligned Security Leader
• Listen to the Cyber Exposure Podcast series, "Interview with Tenable CSO Bob Huber"

*For the purpose of this survey, “business-impacting” relates to a cyberattack or compromise that resulted in one or more of the following: a loss of customer, employee or other confidential data; interruption of day-to-day operations; ransomware payout; financial loss or theft; and/or theft of intellectual property.

Attackers have begun to target a vulnerability in a popular WordPress plugin with over 700,000 active installations, attempting to inject malicious code.

Background

On September 1, researchers at Wordfence published a blog post about a critical vulnerability in File Manager, a popular WordPress Plugin used to manage files on WordPress sites. According to statistics from wordpress.org, the plugin is installed on over 700,000 active WordPress websites. In fact, on August 31, the plugin was downloaded nearly 84,000 times, the highest total daily downloads in all of 2020.

List of daily downloads for the File Manager plugin, which peaked at nearly 84,000 on August 31

Analysis

The vulnerability, which currently does not have a CVE assigned to it, is a remote code execution flaw with a CVSSv3 score of 10.0, the maximum CVSS score. According to Wordfence researchers, the flaw exists due to the improper inclusion of an open-source file manager library called elFinder. It appears that the file connector.minimal.php-dist was stored in an executable format (renamed to .php) and the file “could be accessed by anyone” in order to execute commands via a function in elFinderConnector.class.php.

An attacker could exploit this flaw by sending a specially crafted request to the connector.minimal.php file. Successful exploitation of this vulnerability would allow an attacker to gain remote code execution on the vulnerable WordPress site.

Wordfence notes they’ve observed attacks in the wild, blocking over 450,000 attempts to exploit this vulnerability. A full list of the indicators of compromise can be found in their blog post, and they include a list of files to monitor for in the /wp-content/plugins/wp-file-manager/lib/files path.

Proof of concept

A proof of concept (PoC) exploit script was published to a Github repository on August 25 from a security researcher with the pseudonym of w4fz5uck5. The PoC referenced two previous exploit scripts for CVE-2019-9194, a similar command injection vulnerability in the PHP connector of elFinder before version 2.1.48.

Solution

The File Manager plugin was updated to version 6.9 on September 1 to address this vulnerability by removing several elFinder library files from the plugin. WordPress users that use the File Manager plugin should upgrade to the latest version as soon as possible.

At the time this blog post was published, at least 71.5% of all active File Manager plugin installations are vulnerable, with version 6.5 accounting for over 26% of active installations. The wordpress.org plugin page marks 28.5% of active installations as “other” so it is possible that the actual number of vulnerable sites out there is quite larger.

Active version statistics from the File Manager WordPress plugin page

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• Wordfence Blog Post for File Manager Plugin Vulnerability
• File Manager Plugin Page on WordPress.org
• Changelog for File Manager Plugin to Address Vulnerability
• File Manager Vulnerability Proof of Concept Script

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

TikTok’s popular “#ForYou” page has become a habitat for scammers peddling fake mobile applications, diet pills, drop-shipped goods, fake gift cards and more.

The fate of TikTok’s operations in the U.S., Australia and New Zealand has been a topic of international interest for the past several weeks. Tech giant Microsoft and retail giant Walmart are weighing a joint bid to acquire the businesses and Oracle is also reportedly considering throwing its hat in the ring. However, legal and regulatory challenges are making an already complex negotiation process even more challenging. Even if these considerable hurdles are surmounted, my research over the past seven months reveals some additional challenges a new owner might face in moderating activity on the popular video sharing app. What I found confirms my suspicions that TikTok truly is the Wild West of social media.

The platform raises myriad concerns for a prospective U.S. owner. With a third of its users aged 14 and younger, it’s ripe for exploitation of minors. In addition, we’re already seeing attempts to use the platform to spread misinformation and disinformation related to the U.S. presidential election in November. For the scope of my research, however, I’ve chosen to focus on a plethora of advertising-related scams. Combating these will require any new owner to make a significant investment in beefing up the site’s moderators and implementing new standards and practices to avoid damage to the brand.

TikTok, which is currently owned by Chinese firm ByteDance, has had a monster 2020 so far, setting a record for the most downloads in a single quarter. Children aged four to 14 in the United States, United Kingdom and Spain now spend an average of 80 minutes per day using the app, putting it on par with YouTube. An April report from SensorTower, a mobile app market intelligence firm, found that TikTok has surpassed two billion downloads globally this year.

Source:SensorTower

In 2019, my research into TikTok revealed how popular apps and services have become havens for scammers and how the pursuit of social currency on the network helps fuel an economy for impersonation accounts and services promoting free followers and likes.

Four Types of TikTok Ad Scams

Since early 2020, I’ve been observing how scammers are stepping up their game by pivoting from simply creating accounts on TikTok to exploiting its advertising channels. My research has identified four primary types of TikTok advertisements that are scamming users out of time, money and personally identifiable information:

1. Easy money offers. These offers claim to help users earn money by downloading applications that are either deceitful or questionable in nature, including a series of iMoney applications. These advertisements are problematic because they promote fake apps, lure users into potential pyramid schemes, request personally identifiable information such as driver’s licenses and, in extreme cases, encourage users to install mobile device management (MDM) tools which could potentially compromise their devices.
2. "Free” offers that come with a price. These scams offer everything from free diet pills and “performance enhancers” to video games, headsets and gift cards. They are problematic because they use fake celebrity endorsements and fake news articles to dupe users into providing credit card details in exchange for “free” goods, subjecting unsuspecting users to recurring subscription fees or other types of unreimbursed charges.
3. Dropshipping schemes involving price gouging and questionable goods. These ad scams typically are used to promote questionable or extremely overpriced goods offered by dropshipping. While dropshipping itself isn’t necessarily a scam, these offers are problematic when they involve price gouging, counterfeit or questionable goods, or duping buyers into paying for goods they never receive.
4. Dodgy credit repair and tuition assistance offers. These ad scams prey on those who may be in dire financial straits by promising to repair credit card history or by promoting online classes as a way to access financial aid that they could apply for directly on their own. In many cases, these ads are merely a ruse to entice users to pay for bogus services or share their personally identifiable information.

Just as advertising on Facebook, Instagram and Twitter has created a niche for digital marketing, so, too, has TikTok’s advertising platform enabled advertisers to target its 800 million monthly active users — and scammers are rushing to take advantage of the platform’s scope and reach.

Source:We Are Social

The two types of TikTok feeds

Understanding the significance of the advertising scam trend requires a basic grasp of the TikTok user experience. There are two areas of the application to which I’d like to draw your attention: the Following page and the For You page.

As its name implies, the Following page contains a feed of videos from the TikTokers a user is currently following.

Example of Following page, featuring TikTok creators Addison Rae and The Cheeky Boyos

The For You page is populated with videos curated for each user based on TikTok’s algorithm. The algorithm takes into consideration several factors, such as how users interact with TikTok, including videos they’ve liked in the past or creators they follow. Because it’s algorithmically generated, the For You page presents a greater opportunity than the Following page for advertisers to break through to users based on their interests.

Example of the For You page, featuring recommended videos from the TikTok algorithm

Everyone wants a piece of the For You page

TikTok creators hoping to grow their audience try to find ways to organically appear on the For You page but cracking this code has been difficult over the last year. One of the earliest attempts to make it on this page was to include the hashtags “#foryou” and “#fyp” as part of a video’s captions.

Naturally, scammers have also been trying to crack the same code. Some have had relative success, as I outlined in my first blog on TikTok scams in August 2019.

TikTok ads can only be seen on the For You page

One key part of the TikTok experience is that, when users browse their Following page, they won’t see any advertisements. However, when they browse their For You page, they will see an assortment of advertisements. TikTok provides some examples of successful ad campaigns that have launched on the platform.

Example of legitimate advertisements that appear on TikTok’s “For You” page

The above examples show standard in-app advertisements promoting the Apple TV+ service and Experian’s mobile application. Advertisers can also leverage branded hashtags to further promote their goods and services.

TikTok ads: gateway to the For You page

Brands and scammers alike have the option of purchasing advertising space that will appear on users’ For You pages. While ad rates may vary, TikTok promotions include a one-time $300 ad credit along with a matching top-up credit of up to $2,000, meaning if you purchase $2,000 worth of advertising, TikTok will match it by giving you an additional $2,000 for a total of $4,000 in ad credits.

Details from the TikTok For Business page about a promotional ad credit given to advertisers

We have no way to identify whether the scammers are taking advantage of this credit, but it definitely incentivizes them to utilize TikTok’s ad platform for their own benefit.

A closer look at the four ways scammers are exploiting the TikTok ad network

As noted earlier, my research reveals four primary ways scammers are taking advantage of advertising on For You pages.

1. Easy money offers using questionable and deceitful applications

One of the shadiest tactics I’ve encountered is the use of TikTok ads claiming to offer users money in exchange for “completing tasks” such as downloading a variety of real applications from the App Store and running them for three minutes. Considering TikTok’s popularity among children and teenagers, who typically have little to no disposable income, these advertisements are the perfect disguise for scammers to exploit TikTok’s young user base.

Tricking users into downloading mobile applications is an old tactic used by scammers as part of the “human verification” process, which I’ve written about in my Cash App research. What makes this tactic on TikTok different is that the scammers aren’t taking the “human verification” approach. Instead, they’re using TikTok to promote a series of applications called “iMoney” by using false advertising in two different ways. First, they claim users can earn a high dollar amount for simply downloading mobile applications. Second,they mask the actual application contents by uploading them to the App Store under false pretenses.

Example of a deceptive TikTok ad promoting one of the iMoney applications

These iMoney applications are advertised to TikTok users as ways to earn “$433 Per Day Playing Games,” alongside a screenshot of a PayPal balance screen as “proof.” Other advertisements detail the step-by-step process of how users can “Make Money” easily. The high dollar amount isn’t a true representation of what users can expect to earn just by “playing games,” as my research into these applications will show. While users have the potential to earn money, it’s not a straightforward process, as there are a series of questionable roadblocks before users can allegedly cash in.

When users click on one of these advertisements, they are redirected to Apple’s App Store. There, they are presented with an application masquerading as a completely different app, as shown in the example below. In this case, the TikTok ad references an application called “Super Expense” and its description says it is an app to handle “Simple daily billing expenses, plan your expenses and income” that is designed to help you “understand your financial situation.”

Super Expense is one of several iMoney applications that were masquerading as other apps in Apple’s App Store

Once a user downloads the application on their iOS device, they are initially prompted with a page that looks just like the one in the App Store. However, after a moment, the screen goes blank and another page appears that asks the user a question: “How To Earn Money?” It then details the instructions: Download an app, open the app, play for three minutes, get money.

The first few screens that appear when launching the Super Expense app for the first time

Once the user clicks “Start” the true interface is revealed for an application called iMoney.

iMoney: The hidden interface behind several apps, including Super Expense

There are multiple sections of the application, three of which are highlighted in the images above.

Current Tasks: Earn money for downloading and opening applications

The “Current Tasks” section in the app features a list of 24 applications the user can download to begin earning money. If the user leaves the application open for three minutes, the task is marked complete, which earns the user between $0.18 and $0.23. In total, a user can earn up to $5.02 for completing all 24 tasks.

However, it is unclear when the tasks are refreshed and if a user is only able to complete a certain number of tasks per day. Ironically, one of the tasks includes downloading TikTok. We speculate that when users perform these tasks, they are lining the pockets of the iMoney developers, who are using what’s called an offerwall to promote various apps and pocket an undisclosed sum of money in exchange for getting users to install these apps.

In a private group for the iMoney application, some users have voiced complaints about the inability to cash out their funds. One user noted they have been waiting for “over two months” and now the developers aren’t answering their messages.

Comment from user in the iMoney Facebook Group about not being able to cash out

Amazon Tasks: Get paid to buy Amazon goods and leave positive reviews

There is also a section of the iMoney application for Amazon Tasks. This section incentivizes users to purchase products from Amazon using their own money. Users are promised a refund of the full value of the goods so long as they keep the product and write a positive review for it.

Example of the Amazon Tasks section in the iMoney application

The iMoney application gives detailed instructions on how to find these particular products on Amazon, including the search term to use as well as the position of the item on the search page.

Instructions found in the iMoney app on how to get a refund of the purchased product and the task completion bonus reward

The Amazon Tasks section in iMoney instructs the user to pay for the product and states that the people behind iMoney will “cover the paypal fee and taxes” but that shipping fees are not covered. They ask users to upload a screenshot of their order three hours after it has been placed. They also ask users not to return the goods because Amazon will then “deduct illegal proceeds and blacklist” their account. In the third step, users are instructed to leave a “five star prise [sic]” in the comments section of the product they purchased. In other words, they’re asking for a five-star review. They caution that this review should be left “3 days later after receiving your products” and include an example review.

This tactic appears to skirt Amazon’s requirements that users disclose whether or not a product review was paid for. In addition to receiving reimbursement for the goods purchased, the iMoney application will pay users a small “reward” for completing this task.

Referral section: The real source of income for iMoney users

Finally, the other section worth highlighting is Referrals, where users have the potential to make the most money. This section reveals that iMoney promotes a pyramid or multi-level marketing scheme. For each person you refer to iMoney, you have the potential to earn up to 50% of the reward for the tasks they complete.

Referral bonus table for the iMoney application

A leaderboard in the app shows how much users have earned from referrals. At the time this research was conducted, the leaderboard showed one user had made $772 from referrals alone in a single month.

The iMoney Referral leaderboard showing the top earning referrers for the month

While the app promotes itself as a place where users can earn money in exchange for completing simple tasks, in reality the amount that can be earned this way is negligible. The real driving force is the multi-level-marketing type scheme which incentivizes users to invite a faithful group of “downline” and unsuspecting recruits to download the apps and perform tasks, earning the inviter up to a 50% “commission” on the tasks completed by their downline participants. . While it’s not impossible to make some money through these applications, the promises are misleading; it requires a lot of work and the ability to amass a large group of people to join the service, putting into question the time/value investment of these applications.

A thread from the private iMoney Facebook group showed an exchange between a user who claimed to have seen great success in securing referrals and another lamenting that they’ve not had quite the same luck, noting that they’ve snagged only four referrals with only one referral resulting in task completion. The latter portion of that thread is shown below.

Comment from user in the iMoney Facebook group about not being able to convert referrals

Additional areas of concern in the iMoney application

There are two other areas of concern with the iMoney app. The first is that, after completing a few tasks, the application won’t allow a user to complete any more tasks until they provide some sort of verification.

The iMoney application asks users to provide proof of verification before they can complete more tasks

The app makers are asking users to take photographs of their driver’s license or “other identity info” and upload them through the iMoney app. They say it’s just used for “identity verification” and that they “promise not to disclose your information.”

Comment from a user in the iMoney Facebook group about having to share their driver’s license information with the app

When one user on the private iMoney Facebook group tried to cash out, they were asked for their license. This user questioned the requirement as well as the suggestion that users can “watermark” the photo or cover their name and private information. The user shared a screenshot in which the iMoney developers insisted on a “clear photo” in order to “better pass the audit.”

Message thread between iMoney Support and one of their users about ensuring their driver’s license information isn’t “blocked”

Additionally, the application asks users to install a mobile device management (MDM) profile on their devices.

The iMoney applications ask users to install a mobile device management certificate on their device

Pop-up banners claim this is an “Official Certification from Apple” to “prevent account loss, secure iMoney balance, and get more tasks.” They say this certificate “has been officially certified by Apple and is only used for the legality checking of Apple devices.” This claim is false. MDM is an approved mechanism that Apple provides, but that does not mean this particular certificate has been “certified” by Apple.

Details of the fake Apple mobile device management certificate required to continue using the iMoney application

MDM profiles are typically used by businesses to manage and monitor devices. The fact that iMoney app makers are asking users to install an MDM profile in order for “legality checking” is a highly dangerous prospect and should sound alarm bells for users. There are reports of other applications abusing this business solution to trick users into installing pirated games.

A perusal of social media sites reveals that the iMoney developers largely distributed their application via MDM profiles in the past to skirt App Store guidelines. However, since that cumbersome process hinders their ability to rope in new users, they have since begun distributing their application to a wider audience by creating and uploading fake applications to the Apple App Store.

Several iMoney applications masquerading in the App Store

The Super Expense app isn’t the only fake application that iMoney is hidden behind on the App Store. I found at least five applications, some of which were promoted through TikTok ads or attributed to the same developer on the App Store. These include:

• DaysTaker
• CanEnrich
• OlMoneing
• Minimalist part-time

TikTok ads for these apps also used false advertising, claiming users could earn $10 for completing a task. As we outlined earlier, this isn’t the case, as the most basic task of downloading an app could earn a user a mere 23 cents.

TikTok advertisements with misleading promotions of $10 rewards for completing tasks, or ways to “get fast free money online”

All of these applications masqueraded as something completely different in the Apple App store.

Four applications masquerading in the App Store that are shells for the iMoney application

According to rankings obtained from SensorTower, the CanEnrich app appears to have had the most success, reaching a ranking of #111 on Apple’s Lifestyle category on the App Store in March 2020. DaysTaker reached #151 in January 2020, while Super Expense reached #167 in April 2020.

2. “Free” offers that come with a price: diet pills and other suspect products and services

Example comment from TikTok user on an advertisement

Another area that I encountered during my research involved advertisements for products and services that were suspect in nature. The most egregious of these has been a steady stream of diet pill spam.

Diet pill spam has been on social media for over a decade now. I’ve researched similar campaigns on Twitter, Pinterest and Tumblr, so it’s not surprising to see them surface on TikTok — spammers tend to follow the users, after all. The diet pill advertisements I’ve encountered on TikTok have evolved over time. They initially used weight loss testimonials from YouTube influencers like VitalyzdTv and some other unidentified influencers.

TikTok advertisement features a YouTube influencer’s body transformation to promote a diet pill

The scammers took one of Vitaly’s popular videos with over four million views and repurposed part of it into an advertisement to promote a “Legal Steroid” that is “Turning Men Into Beasts Without Exercise.”

I also observed more comprehensive diet pill ads that included doctored video footage of celebrities like Oprah Winfrey, Blake Shelton and Kelly Clarkson appearing to endorse the products. The videos also featured a montage from the reality TV show “Shark Tank,” featuring footage of Mark Cuban, among others, consuming an undisclosed beverage.

Video stills from TikTok advertisements using fake celebrity endorsements including Oprah Winfrey, Dr. Oz, Blake Shelton, Kelly Clarkson and Mark Cuban

Fake articles promoting diet pills using the Fox News logo and false claims from notable figures

When users click on the advertiser’s name or the link to “Learn More,” they are redirected to a website that features fake articles purporting to be from popular news outlets like Fox News and CNN.

Fake articles promoting diet pills using the CNN News logo and false claims from notable figures

These websites continue to use the existing false celebrity endorsements or they add in new ones, particularly Dwayne “The Rock” Johnson and Kathy Bates. In the case of Kathy Bates, scammers used a pre-existing clip from Dr. Oz’s show and photoshopped an image of a bottle of weight loss pills into her hand.

Actual source of Kathy Bates clip used in the fake CNN article, which added a photoshopped image of a bottle of diet pills

Diving further into these fake news websites, if users click through to get their “free bottle” of pills, they’re met with a similar template.

Diet pill spam on TikTok uses the same template to promote three different pills

Above, you’ll see ads for three different “performance enhancer” pills that use the same basic template of a muscular guy, boilerplate text and a button that says “Rush My Bottle” at the bottom.

These aren’t the only pills I’ve seen promoted. I’ve also encountered ads promoting products using the term “Keto” to take advantage of the popular diet fad.

Diet pill spam capitalizing on interest in the keto diet, while using similar templates to promote different “Keto” pills

Once again, the scammers are utilizing templates for the keto pills, which include KetoFast and Rapid Keto Burn.

The purchase flow for these diet pills shows that if users don’t cancel before their trial period is over, they will be charged nearly $90

Once the scammers convince their victims to accept their “free bottle” of diet pills, the users will be asked to provide their address and payment information. They’ll be told they only have to pay for shipping and handling at a 50% discount. However, if users read the fine print, they’ll see that they’ve enrolled in a trial program that will charge them $90 if they don’t cancel after 14 days. They’re also enrolled in a recurring shipping program, so they’ll continue to receive these pills while also being charged each month until they’ve canceled.

Affiliate offer websites show that the Keto Fast diet pill offer could net a scammer over $100 for a conversion

So, what’s in it for the scammers? Well these websites are part of a cost-per-action (CPA) affiliate program. These programs require the scammers to convince their victims to complete an action in order to meet the CPA criteria. In this case, if the victim submits their credit card information and orders the pills, the scammers can earn close to $111 for each sale.

One way for a savvy user to circumvent dodgy ads would be to go directly to the domain without clicking through the ad. This is difficult for most TikTok ads, which typically use obscure advertiser names that conceal where they are hosted. However, in the case of diet pill spam on TikTok, several examples I encountered used the destination URL as the advertiser name. Many of these diet pill websites are hosted on alternative top level domains like .xyz, .shop and .club. When scammers use the domain name as part of the advertiser name, it saves the step of having to use a tool like Burp Suite to man-in-the-middle your mobile device and identify the destination URL. But if you try to examine one of these websites on a computer, you’re redirected to a different website, meaning the scammers have configured their sites to only accept traffic from mobile devices through the TikTok application.

Additionally, I’ve encountered a trend in which ads feature some fitness-oriented and diet-oriented pre-roll content at the beginning, such as Zumba, exercise machines, recipes or some type of floor workout. There are two possible reasons for this. Perhaps the pre-roll footage is designed to dupe the moderators who are responsible for vetting the advertisements, or perhaps it’s meant to capture the attention of those watching the ads, who may otherwise continue to scroll through the For You page.

Diet pill spam ads on TikTok feature some pre-roll footage to bypass content moderation or to capture the attention of users viewing the ads

Exploiting users through promises of free products

Example of a TikTok advertisement promoting free stuff, in this case showing the ways users can earn free money

There also have been a slew of TikTok advertisements promoting the promise of free goods and gift cards.

Free products and gift card scams aren’t really a new phenomenon, as I wrote about these almost a decade ago. However, they’re certainly new to TikTok. I encountered an advertisement promoting a platform called “You Review, You Keep.”

Example TikTok ad for the You Review, You Keep platform, claiming to offer a free PS4

The advertisement features a montage of people saying they received a free Playstation 4 (PS4) console just for reviewing the product (see example below). Some of the comments on the ad noted that similar actors featured in this advertisement were also used in a free Xbox promotion.

If users click on the link in the advertisement, they’re directed to a website that explicitly states that in order to get your “free” PS4, you have to “Complete ten deals.”

Website for the You Review, You Keep survey that requires users to complete “ten deals” before they can receive their PS4

Once the user completes the initial survey, they’re asked to provide an email address. It also states that by clicking “Continue,” the user agrees to the terms and conditions as well as “mandatory arbitration” with respect to You Review, You Keep. It’s worth noting that Consumer Reports has written about mandatory arbitration, saying it “deprives consumers of important options if a product is faulty or harmful.” This is important when you consider that consumers hoping to get their “free PS4” learn that it’s not free because it requires the completion of “ten deals” via affiliate offers that cost them money.

I also encountered a similar advertisement for free Apple AirPods. The website looks eerily similar to the one from You Review, You Keep. It instructs the user to “Complete ten deals” to get their AirPods. However, in none of the website images are they ever told that the AirPods will be free. In fact, when clicking on the “About our program” section at the bottom of the website, users are told that they have to “Complete your favorite ten deals (purchase required)” in order to get the AirPods.

A TikTok advertisement for free Apple AirPods that links to a similar looking survey website as You Review, You Keep

I also came across advertisements promoting $75 gift cards for popular brands like Chick-fil-A and Starbucks.

TikTok advertisements offering users a $75 gift card to Chick-fil-A and Starbucks

Once again, the sites for these gift cards look identical to the ones I’ve shared above for the PS4 and AirPods.

The website for the Chick-fil-A and Starbucks gift cards looks identical to the ones shared previously for You Review, You Keep and the Apple Airpods

Digging deeper into these sites, we can see that the program requirements are different for these gift cards because their dollar value is less than $100. Instead of having to complete 10 deals, users only have to complete four deals.

The fine print from the Chick-fil-A and Starbucks survey website shows that users need to complete four deals in order to get their gift card

However, users are still required to “complete” deals to get their Chick-fil-A or Starbucks gift card, which just underscores how deceptive these advertisements are. They make bold claims about free stuff, but in reality they string consumers along into signing up for trial offers or purchasing other products in order to get their so-called free products.

3. Promoting the sale of questionable dropshipped products

Considering the popularity of TikTok, it makes sense that scammers would try to leverage the fast-growing platform to promote dropshipped goods. Earlier this year, I observed dropshipping scams on Instagram that circumvented Facebook’s advertising ban on masks. Dropshipping is a big business opportunity, so much so that popular e-commerce solution Shopify provides a guide on how to dropship.

An infographic that explains how dropshipping works (Source: Shopify)

The problem isn’t with dropshipping itself — rather, it’s the scammers taking advantage of unsuspecting customers who are unaware of the true source of the products they’re purchasing and the actual cost of those products. Customers may end up getting the wrong product or may never receive the product at all.

Examples of TikTok advertisements promoting a variety of knock-off massage guns

One of the first batches of dropshipped goods I encountered were massage guns. Several different sellers were promoting them, including one named Hypervolt. This is interesting when you consider that Hyperice is a company that produces a product called the Hypervolt. However, a quick visit to hyperice.com shows a clear discrepancy in the prices between the product being promoted through TikTok and what’s actually offered by Hyperice.

Examples of TikTok advertisements promoting dropshipped goods

Besides the knock-off massage guns, the types of dropshipped goods being promoted vary, including electronics, hardware, kitchen tools, clothing and accessories.

Examples of TikTok advertisements promoting dropshipped goods

All of these advertisements lead users to Shopify-hosted websites promoting these goods.

TikTok ads for dropshipped goods lead to Shopify-hosted websites where purchases are made

These sites promote the goods through their own branded Shopify websites and sell them at a markup. However, they don’t keep the inventory themselves. They source their orders through a website like AliExpress, where these goods can be obtained for a steep discount.

Examples of goods sold on AliExpress for lower cost than advertised in TikTok ads

While all dropshippers will mark up prices to some extent, the ads we’re highlighting veer into the territory of price gouging, with prices for these goods ranging from 60% to 100% above typical retail. They have the goods delivered directly to their customers from the actual suppliers in other countries, including China, Russia, Spain and France. Because the items are shipped from overseas, they can take quite some time to arrive in the U.S. It’s the nature of dropshipping that this also leads to the questionable quality of the goods, since they cannot be verified by the seller.

Comment from a Reddit user about their experience ordering an item from a TikTok ad

For example, I found a thread on Reddit about a fake TikTok advertisement promoting a gaming chair. A user commented on this post saying that when they tried to purchase one of these chairs, they received a $3 phone stand instead. They also placed an order for a second chair before receiving the first one. Unsurprisingly, the second item was another phone stand. They concluded their comment with this warning: “NEVER ORDER FROM TIKTOK ADS THEY CLEARLY DONT SCREEN!”

While legitimate advertisers are certainly present on TikTok, the sheer number of scams I’ve observed compels me to advise users to be cautious about making purchases without first attempting to verify the source and to see if the item they’re about to purchase can’t be obtained directly from AliExpress at a deeper discount.

4. Dodgy credit repair and tuition assistance offers

Finally, I encountered a group of TikTok advertisements targeting users with credit repair and tuition assistance services.

When it comes to credit repair, the primary types of ads I encountered on TikTok included “celebrity endorsements” in the form of rapper and media personality Snoop Dogg, businesswoman Tina Lawson (who is Beyonce’s mother) and musician and TV personality Randy Jackson.

TikTok advertisements promoting credit repair using videos of notable celebrities and figures

The ads begin with these so-called “endorsements” but continue on with paid actors promoting a website for the Finance Council, a company that promises to help lower your credit score with just a 15-minute phone call. (See example below.)

These endorsements appear to be recycled from previous so-called debt relief and credit repair companies. Snoop Dogg was seen promoting such programs in advertisements on Facebook in 2019. In February, an article was published discussing Beyonce’s mom promoting the Finance Council through Snapchat advertisements. That article also points to a story in the New York Times cautioning against debt relief or credit repair companies. It’s likely that sites like the Finance Council capture personally identifiable information from those seeking to improve their credit scores, and may try to sell the users some type of service to improve their credit score. However, what that service entails is unclear.

The website for one of these credit repair programs features an image of Snoop Dogg, but the fine print mentions that the figures shown “may not be associated with the product or service advertised.”

Despite utilizing these celebrity endorsements, the website notes at the very bottom of the page in fine print that these figures “may not be associated with the product or service advertised.” In the case of the Snoop Dogg advertisements that were found on Facebook, VICE News notified Facebook, who found that these ads violated their advertising policies. If they’re in violation on Facebook, they should certainly be in violation on TikTok.

In addition to Lawson’s likeness being used in ads, another group, called Health Insurance Hero, used a pre-recorded video to promote “lower health insurance plans,” once again through a 15-minute phone call.

In addition to using her likeness to promote the Finance Council, a group called Health Insurance Hero features Ms. Lawson in a TikTok advertisement as well as her daughter Beyonce on their website

The website for Health Insurance Hero looks similar to the one for Finance Council, which leads me to believe that the operators of both sites are either the same or using the same template.

Degree Explore claims to offer users $6,000 for “financial aid”

I’ve also encountered ads from Degree Explore promoting sites offering users “financial aid” for college, sometimes specifically referencing online classes. They claim users could get paid over $6,000 to take classes online.

TikTok advertisements promoting ways users can receive “Financial Aid” or get paid to take “Online Classes”

Based on details from the Degree Explore websites, it appears that these offers simply facilitate the application for Federal Pell Grants. These websites are largely designed to collect personally identifiable information from users, which the site owners can then sell. They share this information with partner schools, who give them a kickback for the referrals.

What they don’t tell these students upfront is that several factors come into play when it comes to the grant amount. The Federal Student Aid website says that the exact amount one can expect to receive “Depends on your financial need, the cost of attendance at your school, and more.” Therefore, the claim that all users could earn $6,000 for classes is misleading.

One of the websites from the TikTok advertisements for financial aid details in fine print that these websites receive “revenue from some of the schools that we review” and provides more details about the $6,000 figure

The Federal Student Aid website has a dedicated section on student aid scams. They caution users that they should “never have to pay for help” with their “federal financial aid or student loans,” and advise prospective students to “understand which companies and claims are legitimate.”

TikTok ad scams: Lessons to be learned

As I’ve outlined throughout this blog and my past research into TikTok, a surge in popularity inevitably brings challenges when it comes to moderating content and combating abuse. Over the course of the past decade, I’ve documented these challenges on Facebook, Twitter, Instagram, Snapchat and others as each of these platforms began to emerge as popular destinations for users.

TikTok is no different, which is why it is important for ByteDance — and any new U.S. owner — to prioritize upleveling the app’s content moderation and abuse team in order to curtail these types of questionable ad practices.

There’s ample room for improvement. For example, TikTok’s current functionality for reporting suspicious ads requires the user to provide additional information, including screenshots. This time consuming requirement might deter users from filling out these reports, which would give scammers additional time to run their advertisements.

For users of TikTok, it’s important to recognize that scammers are opportunistic individuals. Scammers see users as a means to an end – the goal is to prey on consumer insecurities and desires to earn fast money, get a good deal on a hot product, lose weight without working out or relieve credit card debt. While we all wish it weren’t so, the reality is there’s no easy way to accomplish these things. TikTok users would do well to be skeptical of many of the advertisements on the platform, because at the end of the day, they’re not always what they appear to be.

Tenable shared our findings with Amazon, Apple, Facebook and TikTok. Amazon confirmed it is “reviewing the report.” Apple removed the iMoney applications from the App Store. TikTok confirmed receipt and responded that it will “direct this to the right person on our team to review.”

Learn More:

• See more from this author here
• Learn more about Tenable Research here
• Read our previous blogs about TikTok social media scams:

1. TikTok Scams: How Popular Apps and Services Become New Havens for Scammers
2. TikTok Scams: How Social Currency Fuels the Economy for Impersonation Accounts and Free-Followers-and-Likes Services

For the fourth month in a row, Microsoft patches over 120 CVEs, addressing 129 CVEs in its September release.

Microsoft patched 129 CVEs in the September 2020 Patch Tuesday release, including 23 CVEs rated critical. This month, several remote code execution (RCE) flaws in Microsoft Office products were patched. Many of these RCEs require a user to open a specially crafted document, making these vulnerabilities a growing concern for e-learning students and teachers alike as they return to school across the U.S. The patches for September include Microsoft Windows, Microsoft Edge, Microsoft ChakraCore, Internet Explorer, SQL Server, Microsoft JET Database Engine, Microsoft Office and Office Services and Web Apps, Microsoft Dynamics, Visual Studio, Microsoft Exchange Server, ASP.NET, Microsoft OneDrive and Azure DevOps.

CVE-2020-1200, CVE-2020-1210, CVE-2020-1452, CVE-2020-1453, CVE-2020-1576, CVE-2020-1460 | Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2020-1200, CVE-2020-1210, CVE-2020-1452, CVE-2020-1453, CVE-2020-1576, and CVE-2020-1460 are RCE vulnerabilities in Microsoft SharePoint when SharePoint fails to properly check the validity of uploaded application packages. An attacker could exploit this vulnerability by uploading a malicious application to a vulnerable SharePoint application or server. These vulnerabilities are reminiscent of CVE-2019-0604, a similar RCE which was exploited nine months after Microsoft released a patch. The same vulnerability continues to be widely used in multiple attacks and was also featured in the CISA top 10 report as one of the top vulnerabilities exploited between 2016 and 2019.

CVE-2020-16875 | Microsoft Exchange Memory Corruption Vulnerability

CVE-2020-16875 is a memory corruption vulnerability in Microsoft Exchange Server software due to improper handling of objects in memory. To exploit this vulnerability, an attacker would simply need to send a malicious email to a vulnerable Exchange server. Successful exploitation would allow an attacker to execute arbitrary code as SYSTEM. This level of access means an attacker would be able to perform a variety of actions, from creating new accounts on the system, to accessing, modifying or removing data, as well as installing programs.

CVE-2020-1252 | Windows Remote Code Execution Vulnerability

CVE-2020-1252 is a vulnerability in Microsoft Windows because of the way objects are handled in memory. In order to exploit this flaw, an attacker would need to trick a user into opening a specially crafted application containing exploit code. Successful exploitation would give the attacker arbitrary code execution on the vulnerable system.

CVE-2020-1057, CVE-2020-1172 and CVE-2020-1180 | Scripting Engine Memory Corruption Vulnerability

CVE-2020-1057, CVE-2020-1172 and CVE-2020-1180 are vulnerabilities in Microsoft’s ChakraCore scripting engine due to the way objects are handled in memory. Exploitation of this flaw would result in memory corruption, which could result in an attacker gaining arbitrary code execution with the same system privileges as the current user. This vulnerability would be amplified if the current user has administrative privileges, because an attacker would be able to perform a variety of administrative actions, resulting in a takeover of the vulnerable system.

CVE-2020-1129 and CVE-2020-1319 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability

CVE-2020-1129 and CVE-2020-1319 are vulnerabilities in the Microsoft Windows Codecs Library because of the way objects are handled in memory. To exploit the flaw, an attacker would need to create a malicious image file that is processed by a program on the vulnerable system. Once exploited, the attacker would be able to access information needed in order to compromise the system.

CVE-2020-0878 | Microsoft Browser Memory Corruption Vulnerability

CVE-2020-0878 is a vulnerability in ChakraCore, Internet Explorer 9 and 11, and Microsoft Edge (EdgeHTML-based) browsers because of the way objects are accessed in memory. Exploitation of this vulnerability would result in memory corruption, which could give an attacker arbitrary code execution on the vulnerable system with the same rights as the current user. This vulnerability would be amplified if the current user has administrative privileges, because an attacker would be able to perform a variety of administrative actions, resulting in a takeover of the vulnerable system. To exploit the flaw, an attacker would first need to plant the exploit code on a website, either by creating a new website or injecting the exploit code on another website. From there, the attacker would need to either utilize social engineering to trick their victim into visiting one of these malicious websites or wait for the users to visit a compromised website.

CVE-2020-1193, CVE-2020-1332, CVE-2020-1335, CVE-2020-1594 | Microsoft Excel Remote Code Execution Vulnerability

CVE-2020-1193, CVE-2020-1332, CVE-2020-1335 and CVE-2020-1594 are RCE vulnerabilities in Microsoft Excel because of the way the software improperly handles objects in memory. To exploit these flaws, an attacker would need to create a malicious Excel file and convince their target to open the file using a vulnerable version of Microsoft Excel either by attaching the file to an email or hosting it on a website and sending a link to their victim via instant message. Once exploited, the attacker would gain arbitrary code execution on the vulnerable system with the same rights as the current user. This vulnerability would be amplified if the current user has administrative privileges, because an attacker would be able to perform a variety of administrative actions, resulting in a takeover of the vulnerable system

CVE-2020-1218, CVE-2020-1338 | Microsoft Word Remote Code Execution Vulnerability

CVE-2020-1218 and CVE-2020-1338 are remote code execution vulnerabilities in Microsoft Word caused by the mishandling of memory objects, which would allow an attacker to execute code as the current user. To exploit this vulnerability, an attacker would be required to entice a user to open a maliciously crafted Word document. An attacker could send the malicious document as an attachment as part of a malicious email. Successful exploitation of this flaw would allow the attacker to execute scripts and perform actions with the permissions of the current user account. This could allow an attacker to take full control of a target if the current user was an administrator.

CVE-2020-0836 and CVE-2020-1228 | Windows DNS Denial of Service Vulnerability

CVE-2020-0836 and CVE-2020-1228 are denial of service (DoS) vulnerabilities within Windows Domain Name System (DNS) due to a parsing error of DNS queries. In order to exploit this issue, an authenticated attacker would need to send a crafted, malicious DNS query to an affected host, resulting in an exhaustion of resources causing the device to become unresponsive. Windows DNS was recently in the news after researchers identified a wormable RCE vulnerability that has persisted in Windows for over 17 years. Dubbed “SIGRed” (CVE-2020-1350), the vulnerability was patched in Microsoft's July 2020 Patch Tuesday update. These two new CVEs within Windows DNS highlight that attackers and researchers alike continue to target applications that have previously faced little scrutiny for security concerns.

While DoS vulnerabilities are lower severity vulnerabilities, the impact of their exploitation can be quite significant. With businesses and schools relying heavily on internet connectivity, attackers are turning to DoS attacks, a tried and true method, to cause havoc.

Tenable solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains September 2020.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s September 2020 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

• Microsoft's September 2020 Security Updates
• Tenable plugins for Microsoft September 2020 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

PAN-OS devices that have enabled the captive portal or multi-factor authentication features are vulnerable to a critical buffer overflow flaw.

Background

On September 9, Palo Alto Networks (PAN) published nine security advisories for a series of vulnerabilities affecting PAN-OS, a custom operating system (OS) found in PAN’s next-generation firewalls. Of the nine security advisories, only one is rated critical.

Analysis

CVE-2020-2040 is a critical buffer overflow vulnerability in PAN-OS when either the Captive Portal or Multi-Factor Authentication (MFA) feature has been enabled. According to PAN’s advisory, a remote, unauthenticated attacker could exploit this vulnerability by sending a malicious request to a vulnerable PAN-OS device when one of these features is enabled. Successful exploitation of this vulnerability could result in the disruption of system processes, as well as allow arbitrary code execution on the PAN-OS devices with root privileges. The vulnerability received a critical CVSSv3 score of 9.8.

PAN explicitly states that GlobalProtect VPN and the PAN-OS management web interfaces are not affected by CVE-2020-2040.

Second Critical PAN-OS vulnerability in three months

This is the second critical vulnerability in PAN-OS devices that has been patched in the last three months. In July, PAN published a security advisory for CVE-2020-2021, another critical PAN-OS flaw that received the highest possible CVSSv3 score of 10.0.

Thousands of PAN-OS devices publicly accessible

A search via Shodan shows that there are over 14,000 PAN-OS devices that are publicly accessible. However, it is unclear how many of the 14,000 PAN-OS devices are indeed vulnerable.

Additional PAN-OS vulnerabilities patched

In addition to CVE-2020-2040, PAN released the following eight security advisories for vulnerabilities in PAN-OS:

Proof of concept

At the time this blog post was published, there was no proof-of-concept (PoC) code for CVE-2020-2040. Because this vulnerability was discovered through an internal security review, a PoC is not expected to be published anytime soon. However, as researchers investigate this vulnerability further, some type of PoC may be released. If and when that changes, we will provide an update.

Solution

PAN released patches to address this vulnerability for the following PAN-OS releases:

PAN notes that all versions of PAN-OS version 8.0 are affected and the only solution to address this vulnerability is to upgrade to another fixed version outside of the 8.0 branch. Additionally, PAN-OS devices running version 10.0 are not affected by this vulnerability.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• PAN-OS Advisory for CVE-2020-2040
• PAN-OS Security Advisories for September 9, 2020

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

To avoid exposure to a variety of web application vulnerabilities, specific security considerations must be made when implementing Cross-Origin Resource Sharing

Today’s modern web applications rely heavily on JavaScript to be dynamic, and ensure the best experience for end-users. Providing content and data to the users often requires interactions with other web applications, which include cross-domain requests and an additional configuration step on the application side known as a Cross-Origin Resource Sharing (CORS) policy.

In this post, we will explain how a misconfiguration of a CORS policy can make your web application vulnerable, and how the Tenable.io Web Application Scanner (WAS) can help you identify these vulnerabilities.

CORS “Origins”

The web application security model implemented by web browsers is built using multiple concepts, with one of the most important being the Same-Origin Policy (SOP). The purpose of the SOP is to restrict interactions between scripts loaded on the origin and the resources hosted on other origins. An origin consists of a combination of the protocol, hostname, and port.

CORS is an extension to the SOP defined by the World Wide Web Consortium (W3C), which enables web applications to add the origins allowed to read responses to cross-domain requests to an allowlist and enforce it at the client browser level.

The implementation of the CORS standard relies on the introduction of multiple Hypertext Transfer Protocol (HTTP) headers used in the communication between the client and the target application.

In the simplest example of implementing CORS, when a web browser loads a web page requesting cross-domain resources, the Origin HTTP header is added in the request to the external resource. The application’s response will then include the Access-Control-Allow-Origin header to define which origins are authorized to read the application responses. In certain instances, the Access-Control-Allow-Credentials header may also be part of the responseto specify whether or not the calling script is allowed to ask the browser to include credentials in the cross-domain request, such as session cookies, authorization headers, or TLS client certificates. Upon receiving the cross-domain target application’s response, the client browser checks if the origin is granted to read the response or blocks it according to the configured CORS policy.

Complex requests like the ones using specific HTTP methods, such as PUT or DELETE, or custom HTTP headers will trigger an additional request called apreflight request. The preflight request is first issued with an OPTIONSrequest, which is designed to check if the target application has CORS enabled and supports the different options sent in the request.

In this situation, the application response contains additional headers like the Access-Control-Allow-Methods HTTP header, which specifies the HTTP methods allowed when using cross-domains requests.

Once the preflight request is complete, the real request is sent to the target application.

Common vulnerabilities

Because CORS is an access control mechanism, it can be misconfigured, thereby enabling an attacker to bypass it and make the client browser act as a proxy between a malicious website and the target web application. Most of the time the related security risk is underestimated and becomes more important when the web application allows authenticated requests.

One of the most common misconfigurations is the value defined in the Access-Control-Allow-Origin header sent back by the application. The list below describes some of the most common errors made when defining a CORS policy

• When using a wildcard with a value of an asterisk (*) in the Access-Control-Allow-Origin header, any origin is allowed to read responses from cross-domains requests. The CORS specification includes a particular security check for this scenario that prevents the Access-Control-Allow-Credentials header to be set to “true” in this case.
• Using a “null” value and assuming this will disable cross-domain request capabilities. On the contrary, this configuration has the same impact as using a wildcard. Web browsers automatically use the null origin in some circumstances, such as after a CORS request has been redirected by the target resource, or when this request has been sent from a specific resource type (for example, from an iframe, or using a local file).
• Building dynamic Access-Control-Allow-Origin with improper server-side validation. The specification only defines a single origin in the Access-Control-Allow-Origin response header. When multiple origins need to be trusted, developers have to deal with dynamic validation of the origin by using regular expressions based on the target application domain.

In the case of misconfiguration, the regular expression can, for example, implicitly authorize the application derived hostname. In other situations, the Origin header sent by the web browser is simply reflected, leading to the same impact as using a wildcard value. This is a common practice to circumvent the control that prevents using both the wildcard allowlist and the credentials.

• “Trusting” public third party services. Hosting infrastructures like Cloud providers (storage buckets), content delivery networks (CDNs), or code hosting services are sometimes allowed in the CORS policy. By definition, these public services are available for a potential attacker who can leverage them to host malicious JavaScript code and issue cross-domain requests to the vulnerable application.

Exploitation and security risks

With some background on the different vulnerabilities associated with CORS misconfigurations, let’s have a look at the security risks and impacts.

The common exploitation scenarios can be described by the following steps:

1. An attacker sets up a malicious website hosting JavaScript code, which aims to retrieve data from a vulnerable web application.
2. The attacker entices the victim to visit the website using phishing or an unvalidated redirection in the target application.
3. The JavaScript code is then loaded in the victim browser and performs silent cross-domain authenticated requests to the target application to steal data and store it.

Although the risk increases when the CORS policy allows the usage of requests with credentials, there can be situations where a simple origin that is not properly validated can have a big impact. For example, intranet web applications sometimes do not follow a standard security design and may allow any user located on the corporate network to reach its internal content without authentication. If the application's CORS policy is not correctly enforced and the victim user visits the malicious website, this could result in an information leak.

Information leakage is a basic exploitation case of CORS vulnerabilities. However, attackers often leverage these issues to perform advanced attack scenarios, which can lead to the takeover of application user accounts or the execution of arbitrary modifications in the target application on behalf of the victim user. Earlier this year, Chris Lyne, senior research engineer on Tenable’s Zero Day Research Team, disclosed a vulnerability in Plex Media Server due to a weak CORS policy and described the related risks for the Plex application users.

Leverage Tenable.io WAS to detect CORS issues

Tenable.io WAS helps you identify CORS issues with multiple plugins designed to audit a web application during a scan. The main purpose is to be able to:

• Check that the Access-Control-Allow-Origin is not too permissive according to the best practices.

• Verify that the origin validation is properly enforced by using the most common bypasses known by Tenable Research.

Once detection of a CORS issue occurs, Tenable.io WAS provides the relevant information helping identify the configuration to fix, as well as the related guidance to remediate the issue.

Generally speaking, CORS vulnerabilities are configuration errors and can be easily fixed with the following principles:

• If the application does not require cross-origin requests, the only action is to check that no policy is set.
• Always ensure that the Access-Control-Allow-Origin header allows the most specific origins and is not over permissive. A wildcard configuration should only be defined when the whole content of the application is made to be public.
• Restrict the Access-Control-Allow-Methods header to match what the application needs.
• Consider using real “trusted” origins. By default, public Cloud providers or services like GitHub Pages should not be in your trust zone when dealing with CORS.
• Set the Access-Control-Allow-Credentials header to true only when required and after having validated that the Access-Control-Allow-Origin header is properly set.

Finally, it is important to note that a CORS policy is not a security feature by itself and still requires common application security best practices.

Get more information

• Tenable.io Web App Scanning
• Mozilla Developer Network - Cross-Origin Resource Sharing
• OWASP HTML5 Security Cheat Sheet - Cross-Origin Resource Sharing
• Plex Media Server Weak CORS Policy (TRA-2020-35)
• Insecure 'Access-Control-Allow-Origin' Header (Plugin ID 98057)
• Insecure Cross-Origin Resource Sharing Configuration (Plugin ID 98983)

Conduct compliance audit scans effectively and efficiently with Nessus Professional by leveraging these best practices. 

Tasks required to maintain compliance don't find themselves on most people's lists of favorite activities. But while such regulatory responsibilities can sometimes be taxing, complex or tedious, that doesn't make them any less necessary. Among the standards and practices pertaining to information security, compliance scanning is one of the most important.

Some in your organization may worry about performing a compliance scan of your network: Perhaps they think it's the same thing as a system-wide vulnerability scan and are worried about potential operational delays (though this is something of a misconception). Or maybe they're simply hoping to complete the process as soon as possible. As such, it will be critical to make sure your compliance scanning is as efficient and effective as possible. Following a few best practices can help you maximize the compliance audit functionality available in Nessus Professional.

Determine your scanning priorities

"Standards" and "regulations" are umbrella words that mean a lot of different things to different organizations. The business next door might solely adhere to PCI DSS for their payment processing, whereas you might also have HIPAA and GDPR to contend with. And then there may be "voluntary," but ultimately no less valuable, guidelines to follow like the security standards CIS creates for dozens of applications and operating systems. 

You don't have to conduct compliance audit scans for all standards you follow at the same time. Even if your system could handle the traffic that such a broad operation would create, it would slow everything down to a snail's pace and leave a lot of your peers frustrated (particularly everyone in IT). We recommend creating independent scans for each standard against which you're testing compliance to reduce the load and simplify reporting.

In other words, you'll want to schedule compliance scans around both regulatory and operational needs: for example, starting with PCI DSS in one scanning window, and then periodically rotating through the other standards. Prioritize anything that may have a specific recertification time frame, of course. So if it's been almost a year since your last PCI certification (or three months since your last scan),¹ that should probably be at the top of your list for the moment.

Template-based and customized compliance scans

When you run Nessus Professional "straight out of the box," so to speak, it runs all of its compliance scanning operations based on templated policies for specific standards. In more than a few use cases, that may be all that's needed, as the audit templates cover a broad swath of protocols for all of the major operating systems. 

But that won't be true for every organization. Maybe your IT team has developed unique configurations for your registry values that a templated scan wouldn't properly analyze, or perhaps the terms of a particular standard changed a few hours ago and you need to change the existing audit policy to reflect that. Doing so is simple with Nessus - you and your infosec team can download the raw text files of the policies and modify them according to your precise scanning requirements.

Authenticate with credentials

You’ll need credentials to authenticate the execution of your compliance scans. With credentials, you'll be able to track down and resolve flaws, coding, configurations or other digital assets that represent even the slightest deviations from the standards you're obligated to uphold. This minimizes the risk of accruing fines or sanctions from either government agencies or industry regulators.

It's important to remember that credentialed compliance scans should be conducted using a dedicated account – one you create from scratch and provide with all appropriate administrator-level permissions. Doing so serves a dual purpose: You avoid exposing the admin-level credentials of an actual executive or member to a third-party application while allowing the solution to access all necessary areas of the network and paint the most accurate possible picture of your digital compliance. For added security, you can disable the auditing account whenever it isn't actively being used.²

Understand the compliance audit limits

To paraphrase Clint Eastwood: "An infosec operation's got to know its limitations." 

Lest you misinterpret this, there are little to no limits to a properly credentialed compliance audit conducted with Nessus. But compliance auditing and vulnerability scanning, which aren't identical, are sometimes confused with each other.

To achieve both optimal compliance and comprehensive network protection, it's critical that you run compliance audits in close coordination with vulnerability scanning. Stagger these processes appropriately to avoid major operational interruption, but not by too long: You don't want to risk missing a network issue that could either leave you open to a cyberattack or get you in hot water with a regulator. 

Nessus Professional can help give you the network visibility you need. 

Start Your Free Nessus Trial

_{1. Merchant Services, "PCI DSS Frequently Asked Questions"
2. Security Boulevard, "Why You Should Perform Credentialed Scanning," April 2018}

Security researchers reveal how the cryptographic authentication scheme in Netlogon can be exploited to take control of a Windows domain controller (DC).

Background

On September 11, researchers at Secura published a blog post for a critical vulnerability they’ve dubbed “Zerologon.” The blog post contains a whitepaper explaining the full impact and execution of the vulnerability, identified as CVE-2020-1472, which received a CVSSv3 score of 10.0, the maximum score. Zerologon was patched by Microsoft in the August Patch Tuesday round of updates. This disclosure follows a previous Netlogon related vulnerability, CVE-2019-1424, which Secura detailed at the end of last year.

Analysis

CVE-2020-1472 is a privilege escalation vulnerability due to the insecure usage of AES-CFB8 encryption for Netlogon sessions. The AES-CFB8 standard requires that each byte of plaintext, like a password, must have a randomized initialization vector (IV) so that passwords can’t be guessed. The ComputeNetlogonCredential function in Netlogon sets the IV to a fixed 16 bits, which means an attacker could control the deciphered text. An attacker can exploit this flaw to impersonate the identity of any machine on a network when attempting to authenticate to the Domain Controller (DC). Further attacks are then possible, including the complete takeover of a Windows domain. Secura’s whitepaper also notes that an attacker would be able to simply run Impacket’s ‘secretsdump’ script to pull a list of user hashes from a target DC.

In order to exploit this vulnerability, the attacker would need to launch the attack from a machine on the same Local Area Network (LAN) as their target. A vulnerable client or DC exposed to the internet is not exploitable by itself. The attack requires that the spoofed login works like a normal domain login attempt. Active Directory (AD) would need to recognize the connecting client as being within its logical topology, which external addresses wouldn’t have.

Image source: Secura CVE-2020-1472 Whitepaper

Proof of concept

Several proofs of concept (PoCs) have been published to GitHub ^[1][2][3][4] which demonstrates wide interest and experimentation across the security community. Researchers have been fast at work to confirm successful exploitation. Critical and high profile vulnerabilities tend to receive widespread interest from security researchers and attackers alike.

In a hypothetical attack, one could use this vulnerability to deploy ransomware throughout an organization and maintain a persistent presence if cleanup and restoration efforts miss any additional malicious scripts. Organizations with network-accessible backups could end up with a perfect storm if a ransomware group destroys backups to increase their likelihood of payout from the victim organization.

Solution

Applying the August Patch Tuesday update from Microsoft's Advisory will fix the vulnerability by enforcing remote procedure call (RPC) in the Netlogon protocol for all Windows devices. Tenable strongly encourages users and admins alike to apply this patch as soon as possible.

Yeah, I can confirm that this public exploit for Zerologon (CVE-2020-1472) works. Anybody who has not installed the patch from August's Patch Tuesday already is going to be in much worse shape than they already were.https://t.co/SWK2hUDOYchttps://t.co/0SDFfageQCpic.twitter.com/Lg8auMdtVU

— Will Dormann (@wdormann) September 14, 2020

Users should be aware that Microsoft notes a revision to this advisory will be coming on February 9, 2021, and that, once the enforcement phase begins, enforcement mode will be required for all non-Windows devices. Administrators can manually allow specific devices through group policy for legacy device needs.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability can be found here. Tenable will also be releasing additional plugins for the February 9, 2021, update. A compliance audit file, available here, can be used to ensure that the FullSecureChannelProtection registry key value is set in group policy on the DC. The August 2020 fix should set this registry key after the patch has successfully been applied.

Get more information

• Tenable's August 2020 Patch Tuesday Blog
• Secura's Zerologon Whitepaper
• Microsoft Guidance on "How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

How do you communicate the business risk context of your cybersecurity program to your organization’s C-level executives? This is a question I grapple with every day in my role as a cybersecurity leader.

Security and risk management leaders have an arsenal of frameworks and controls at our disposal with which we can measure the most granular facets of our programs. While such metrics are invaluable in helping us manage the day-to-day operations of our teams, they fall short when it comes to finding a way to speak to our business leaders.

When you're interacting at the C-level or even at the audit committee level — which more often than not is the board entity responsible for security — executives want to understand what impact your cybersecurity program is having on the organization’s ability to fulfill its core value proposition. Yet, a global commissioned study of more than 800 business and cybersecurity leaders conducted by Forrester Consulting on behalf of Tenable reveals that 66% of business leaders are — at most — only somewhat confident in their security team’s ability to quantify their organization’s level of risk or security.

This is not to suggest that security leaders are doing something wrong. Rather, it shines a clear spotlight on an unavoidable reality: Current ways of measuring cyber risk don’t provide the business context organizations require. Over half of security leaders surveyed lack confidence that they have the technology or processes to predict cybersecurity threats to their business while roughly two-fifths are unsure they have the data.

Cesar Garza, CISO at Home Depot Mexico in San Pedro, Mexico, describes the challenges in a single word: “Findings.” In an interview with Tenable, Garza said “For us, determining our level of cyber risk is not that hard. We have maturity assessments, vulnerability assessments, penetration tests and all sorts of audits and assessments sent to us by [global corporate headquarters]. The hard part is what to do with all the findings. Most of the findings require investment, OpEx for the rest of eternity, increasing workforce or investing in new technology.”

How do we calculate cyber risk?

Cyber risk is a function of your assets, security controls, threats and vulnerabilities at any given point in time. Without knowing which assets are most critical to your core business value, it’s impossible to arrive at an understanding of which cyber risks represent an actual threat to your business. Once you’ve determined your most critical assets, the next step is to understand which of the tens of thousands of threats and vulnerabilities facing your organization each year actually pose the greatest risk to those core assets.

According to the Forrester study, fewer than 50% of security leaders are framing the impact of cybersecurity threats within the context of a specific business risk. The majority of security leaders polled (56%) are not applying business risk management objectives to their vulnerability prioritization processes. Only half (51%) say their organization works closely with business stakeholders to align cost, performance and risk-reduction objectives with business needs. And just one in four report that they regularly review the security organization’s performance metrics with their business counterparts.

The Forrester study also reveals:

• More than half of security leaders (56%) say their organization lacks good visibility into the security of their most critical assets.
• Approximately 60% of respondents report high or complete visibility into risk assessments for on-premises employees, but only 52% can say the same when employees are remote or working from home.
• Just 51% report having high or complete visibility into systems used by contractors or partners and 55% report the same for their third-party vendors.

You can’t calculate cyber risk without business context

The two most common questions I get asked by senior business leaders and the board include: “Are we secure?” and “How does our program compare to peers?”

But, unlike our business counterparts, security leaders have limited objective data upon which to build the cyber risk equation of assets, security controls, threats and vulnerabilities required to answer both questions. No existing framework captures the entirety of our operation, leaving security leaders to cobble together a hodgepodge of measures. Without an objective measure of the business context for each of our assets, our cyber risk calculations can only take us so far.

Indeed, according to the Forrester study, fewer than half of security leaders consider the industry benchmarking frameworks they use to be very effective in accurately reporting on business risk. And more than half say they are not doing an adequate job benchmarking their security controls.

At the same time, there are so many variables involved in any organization’s attack surface that achieving industry-wide consensus on security metrics is likely to remain a holy grail for the foreseeable future. No organization can ever claim to be 100% secure. All we have is our informed calculation of what’s considered an acceptable level of risk, which allows us to make business decisions about how far to go once we’ve addressed a reasonable level of exposure.

So, how can you work with what you have in order to begin bridging the disconnect between cybersecurity and the business?

There’s no one-size-fits-all answer but we can turn to LafargeHolcim IT EMEA in Madrid for one example. “We evaluate our penetration ratio throughout the different layers of protection in place,” said Jose Maria Labernia Salvador, the company’s head of IT security and internal control, in an interview with Tenable. “This helps our business to understand the potential exposure in our landscape and determine their risk appetite throughout the cybersecurity value chain. Our model is KPI-oriented and is data- or segment-oriented agnostic, as you never know what will be the initial attack vector with potential to move laterally and harm our organization.”

Using the data you have to get to where you need to go

Risk is relative, not absolute. We will always have risk within the enterprise. The question is whether we reduced or increased our risk by taking a particular business action. What the currently available security assessment options do is give you the ability to snap a chalk line, so you have a starting place from which you can begin to identify the work needed to further refine your security program.

At Home Depot Mexico, Garza turns to Tenable.io with Lumin to achieve “visibility in almost real time of our current level of cyber exposure. We can prioritize cyber risks and have all this in one screen.” He noted that the organization is in the process of building an executive dashboard that will give visibility to its C-level executives.

There is no one-size-fits-all approach to identifying the key risk indicators that matter most to your organization. All we can do, as industry professionals, is work together to begin formulating the kinds of business risk metrics that will be most meaningful to C-level business leaders.

To that end, I leave you with the following list of the questions I’ve been asked by boards and C-level executives in the course of my career:

• What and/or where are our most critical risks, functions, and assets?
  • What are you doing to protect them?
• How mature is our program compared to the industry and our peers?
  • What is your roadmap to improve our maturity?
• How is our security program resourced compared to competitors or peers in our industry sector?
• Are our most business-critical functions more secure today than they were a year ago?
• What are we doing about (insert latest headline-grabbing vulnerability here)?

My hope is that these will spark your own ideas for other business risk indicators worth measuring so that, collectively, we can find better ways to achieve alignment between cybersecurity and the business.

Previous blogs in this series focused on the challenges of aligning cybersecurity and business and why cybersecurity leaders struggle to answer the question “how secure, or at risk, are we?”. We also examined what COVID-19 response strategies reveal about the business-cyber disconnect. In future posts, we’ll explore five steps for achieving alignment with the business, and spend a day in the life of a business-aligned security leader.

Learn more:

• See additional study highlights here
• Download the full study, The Rise of the Business-Aligned Security Executive
• Read the blogs
  • Aligning Cybersecurity and the Business: Nobody Said It Was Easy
  • Why Cybersecurity Leaders Struggle to Answer the Question ‘How Secure Are We?’
  • What COVID-19 Response Strategies Reveal About the Business-Cyber Disconnect
• Download the white paper, What It Takes to Be a Business-Aligned Cybersecurity Leader
• Read the eBook, How to Become a Business-Aligned Security Leader
• Listen to the Cyber Exposure Podcast series, "Interview with Tenable CSO Bob Huber"

CISA warns that foreign threat actors from China and Iran are routinely targeting unpatched vulnerabilities across government agencies and U.S.-based networks.

Background

On September 14 and September 15, the Cybersecurity Infrastructure Security Agency (CISA) published two separate alerts detailing malicious activity from foreign threat actors:

• AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity
• AA20-259A: Iran-based Threat Actor Exploits VPN Vulnerabilities

According to CISA, these foreign threat actors have been leveraging a number of unpatched vulnerabilities across a variety of networking devices and mail server software as part of a concerted effort to breach organizations. CISA has observed these attacks against federal government agencies and other networks based in the United States.

The table below contains the list of vulnerabilities mentioned in both alerts (with the exception of CVE-2019-11539, which appears only in AA20-259A):

*Please note Tenable VPR scores are calculated nightly. This blog post was published on September 17 and reflects VPR at that time.

The vulnerabilities in these alerts were disclosed between April 2019 and July 2020. These threat actors are banking on the fact that organizations are slow to apply patches on these devices.

Analysis

CVE-2019-11510, CVE-2019-11539: Pulse Connect Secure Vulnerabilities

CISA reports that foreign threat actors in China and Iran are exploiting flaws in Pulse Connect Secure, a popular commercial virtual private network (VPN) solution. These vulnerabilities were originally patched back in April 2019. However, they began to garner more attention after researchers Orange Tsai and Meh Change of the DEVCORE research team disclosed their findings for these vulnerabilities at the Black Hat and DEFCON conferences in August 2019. A proof of concept (PoC) was released for CVE-2019-11510, a pre-authentication arbitrary file disclosure vulnerability that is used to read sensitive information from the Pulse Connect Secure device, including configuration settings. Soon after the release of the PoC, reports emerged that attackers had begun to exploit the flaw in the wild.

The Iran-based threat actor referenced in AA20-259A is also utilizing CVE-2019-11539, a post-authentication command injection vulnerability in the Pulse Connect Secure administrative web interface that could allow an attacker to inject and execute commands on the device. Because CVE-2019-11510 is a pre-authentication vulnerability used to gather admin credentials, attackers are chaining it together with CVE-2019-11539 to gain a Secure Shell (SSH) shell on the vulnerable device with root privileges. Researchers Alyssa Herrera, Justin Wagner and Mimir published a blog post showing how this process works.

CVE-2019-11510 has become a popular tool in the attackers’ toolkit. In January 2020, reports emerged that the vulnerability had been used as part of the Sodinokibi ransomware attacks. CISA also included this vulnerability in its Top 10 Routinely Exploited Vulnerabilities alert in May as one of two vulnerabilities that were routinely exploited by foreign threat actors in 2020.

CVE-2019-19781: Citrix Directory Traversal Vulnerability

In December 2019, Citrix published an advisory for a directory traversal vulnerability in its Application Delivery Controller (ADC) and Gateway products. At the time, they did not provide a patch for the flaw.

A few weeks after disclosing this vulnerability, researchers began to observe attempts to exploit the flaw in the wild. Several researchers shared some technical information in blog posts detailing the flaw, which ultimately led to the publication of exploit scripts. Soon after, attackers began to actively exploit the vulnerability en masse while patches remained unavailable until one month after its initial disclosure.

Just like CVE-2019-11510, CVE-2019-19781 was also included by CISA in its Top 10 Routinely Exploited Vulnerabilities alert.

CVE-2020-0688: Microsoft Exchange Server Static Key Flaw

In February 2020, Microsoft published an advisory for a severe vulnerability in Microsoft Exchange Server that was initially mislabeled as a memory corruption flaw. The vulnerability, identified as CVE-2020-0688, is a static key vulnerability in a component of Exchange Server called the Microsoft Exchange Control Panel (ECP).

A detailed breakdown of the flaw was published on the Zero Day Initiative blog, which clarified that exploitation would require the attacker to obtain valid user credentials from the targeted Exchange Server. This requirement was deemed “not a big hurdle” by security researcher Kevin Beaumont, who noted that the availability of open-source tools can be used to scrape LinkedIn pages for employee names, which can then be leveraged as part of credential stuffing attacks.

At the time, Beaumont also noted that organizations were “averaging in the years rather than months behind” patching their Microsoft Exchange Servers. Clearly that has proven to be valuable for foreign threat actors who have leveraged this flaw as part of their attacks.

CVE-2020-5902: F5 BIG-IP Unauthenticated Command Execution Vulnerability

At the end of June 2020, F5 published an advisory for CVE-2020-5902, a critical command execution vulnerability in its BIG-IP family of products. The vulnerability exists in the BIG-IP Configuration Utility, referred to as the Traffic Management User Interface (TMUI). To exploit the flaw, the TMUI would need to be exposed through a BIG-IP management port or Self IPs.

Ben Goerz, a senior manager of counter-threat management at Kimberly-Clark, tweeted that default configurations of BIG-IP devices are vulnerable to CVE-2020-5902 due to the usage of Self IPs. A senior security engineer at F5 confirmed in a tweet that while BIG-IP versions 11.5.2 and prior use Self IPs by default, this configuration no longer applies in BIG-IP versions 11.5.3 and later.

At the time, researcher Nate Warfield identified over 8,000 publicly accessible hosts with management ports exposed. Soon after its disclosure, reports emerged that threat actors were actively exploiting CVE-2020-5902. This vulnerability has proven to be a valuable commodity for both cybercriminals and foreign threat actors.

Unpatched vulnerabilities are a boon for cybercriminals and threat actors

The Top 10 Routinely Exploited Vulnerabilities alert highlights an important point: Threat actors do not need to spend capital obtaining or developing zero-day vulnerabilities, or burn the ones they already have, when unpatched vulnerabilities remain a consistent challenge for organizations. This challenge is reinforced by easy access to publicly available PoC and exploit scripts that attackers can repurpose as-is in order to breach organizations.

In June 2020, the Australian Cyber Security Centre published a report titled “Copy-Paste Compromises,” which details a concerted effort by foreign threat actors to target governments and organizations by copy-pasting PoC and exploit script code. Both CISA alerts highlight the exact same challenge: Readily accessible PoC and exploit scripts, and the presence of unpatched vulnerabilities, make it that much easier for cybercriminals and foreign threat actors to breach governments and organizations across the world.

Proof of concept

All of the vulnerabilities identified in the CISA alerts have had public PoC code and exploit scripts available soon after they were publicly disclosed. For many of the CVEs, multiple PoCs and exploit scripts have been published. We have shared a small subset of these in the table below:

Solution

With the exception of CVE-2019-19781, patches were made available for these vulnerabilities at the time the advisories were published. In the case of CVE-2019-19781, patches were not made available until one month after the initial advisory.

Please refer to the individual advisories below to determine which patch to apply for your specific device.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities can be found below:

• CVE-2019-11510, CVE-2019-11539
• CVE-2019-19781
• CVE-2020-0688
• CVE-2020-5902

Get more information

• CISA Alert AA20-258A
• CISA Alert AA20-259A
• CISA Top 10 Routinely Exploited Vulnerabilities
• Tenable Blog for CVE-2019-11510 and CVE-2019-11539
• Tenable Blog for CVE-2019-11510 Exploited in the Wild
• Tenable Blog for CVE-2019-11510 Used in Ransomware Attacks
• Tenable Blog for CVE-2019-19781
• Tenable Blog for CVE-2019-19781 Exploit Scripts
• Tenable Blog for CVE-2019-19781 Exploited in the Wild
• Tenable Blog for CVE-2020-0688
• Tenable Blog for CVE-2020-5902
• Tenable Blog for Copy-Paste Compromises

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Moving from legacy vulnerability management to a risk-based approach can be a paradigm shift, requiring not only new technologies, but changes in your existing processes and procedures. Here’s a brief overview of how you can get started.

Vulnerability management can often feel like a never-ending game of Whac-a-Mole. Fix one vulnerability and several more pop up elsewhere. As the number of new vulnerabilities continues to skyrocket, it’s become clear that legacy VM practices are no longer sufficient at keeping up and addressing the risks that matter most. 

The problem is legacy VM tools are inefficient at best. They assess only traditional, on-premises IT environments, and their periodic scans don’t reflect the evolving threat landscape. They also lack the context you need to prioritize which vulnerabilities to remediate first. 

Of course, this inefficiency didn’t happen overnight and isn’t the result of any one thing. Organizations have been slow to adapt to incremental changes in several different areas over time. Fortunately, the tools and best practices now exist to help your team quickly evolve your VM program to meet the demands of the modern attack surface.

Moving from reactive to proactive: The lifecycle for risk-based VM

As a general rule, you want to evolve from a highly reactive VM program, which is interrupt-driven and error-prone, to an approach that is proactive and strategic so you can maximize your efficiency and effectiveness. In other words, you need to get out of firefighting mode so you can focus on the vulnerabilities that pose the greatest risk. How can you accomplish this? In addition to investing in an expanded set of tools, your organization will need to update its VM policies and procedures to keep pace with evolving cyberthreats.

At Tenable, we think about this organizational process as a five-step lifecycle:

Rather than just discovering and assessing vulnerabilities, risk-based VM enables you to effectively prioritize them by understanding the full context of each vulnerability, determine the appropriate action to take, and calculate key metrics as well as compare against industry standards. A few of the many ways this can benefit your organization includes: 

• Prioritize valuable security and IT resources
• Optimize the team’s efficiency
• Reduce business risk
• Minimize VM program costs
• Improve security reporting
• Build confidence across the C-suite

Discover critical business services across your attack surface

The first step in a risk-based VM strategy is to take the time to truly understand your business environment. That means determining and prioritizing business-critical services and applications, identifying service and application owners and other stakeholders, and evaluating existing security and applicable IT policies and processes. 

You don’t necessarily need tools for this step, but you do need cooperation from the rest of your organization– particularly from the owners of all business-critical assets, applications and services. You need their permission to access their assets for scans, patching and other security measures. You also have to work out a schedule to ensure that your actions won’t interfere with the availability of their services.

Assess your network with frequent scans to eliminate blind spots

Next, you’ll need to fully assess all your assets. That means you’ll need a new scanner – one that can go beyond your traditional IT network to assess your entire attack surface, including any assets you have in cloud, operational technology (OT) and container environments. Having an integrated web app scanner is important too, since the majority of your organization’s sensitive data lives in, or runs through, apps – which has made the application layer a primary attack vector.

But simply upgrading your tools isn’t enough. You’ll also need to examine your security processes. Are you scanning enough of your network? Any assets your scanners can’t see puts you at risk from critical vulnerabilities that may reside on those assets. You also have to determine if you’re scanning frequently enough. Many organizations employing legacy VM methods scan monthly or less frequently. As a result, they’re basing their remediation decisions on old, outdated information. The threat landscape is dynamic in nature, so you’ll want your security intelligence to be dynamic, as well.

Prioritize vulnerabilities based on asset criticality and attacker activity

Once you can see all the vulnerabilities across your entire attack surface, you need to understand them in the context of business risk and use that data to prioritize your team’s efforts. That means you need a VM platform capable of analyzing the vulnerability data that comes from your scanners, together with other essential contextual elements, including the criticality of the affected assets and an assessment of current and likely future attacker activity. 

Of course, analyzing all this data simply isn’t practical to do on your own. So, you’ll want your VM platform to employ automation and machine learning, so it’s capable of rendering an accurate decision in seconds.

As you continue to refine your prioritization strategy, make sure your assessment windows work well for each asset to minimize business disruptions while achieving reasonable service-level agreements (SLAs). This is tied to the work you did in step 1, when you took the time to understand the business environment and established agreements on patch windows. After all, achieving your SLAs is meaningless if the cost to the business is greater than the benefit of the fix.

Remediate or mitigate critical vulnerabilities 

Once you’ve determined which vulnerabilities are the highest priority, you’ll want your VM platform to tightly integrate with your ticketing system so you can send tickets directly to IT, pre-populated with the information they’ll need to understand what to fix, how to fix it and why it’s a priority. Auto-ticketing capabilities further streamline the effort and maximize the efficiency of the entire process. Communications should also be bi-directional so IT can initiate scans to validate their remediations.

Keep in mind that you can’t remediate everything, and doing so isn’t necessarily the best use of your security resources. Instead, you’ll want to determine the implications of remediating each prioritized vulnerability. Is remediation feasible? If not, are mitigation factors in place that reduce or neutralize the threat exposure? Can you afford to simply accept the risk and take no action at all? Risk acceptance may be appropriate if the vulnerability is on a non-critical asset, or it may be necessary if the remediation runs the risk of breaking critical processes that are running on the asset.

In many cases, you’ll need to get agreement from each asset owner on your response plan before you take any action. And once you perform the remediation, you’ll need to validate its effectiveness before moving on to the next vuln.

Measure to communicate your security progress

Finally, you need a rich set of reporting and analysis tools to effectively communicate the team’s efficiency – to gain and maintain management’s confidence in your abilities. In addition to the tools, themselves, you’ll need to work with the various security groups throughout the organization to develop common dashboards that ensure consistent reporting. You’ll also need to work with your management to decide when and how often reporting should occur.

As with most of the prior steps we’ve discussed, the weaknesses you’ll need to address here are on the human side, rather than with the technology. You’ll need to decide as an organization what KPIs are most important, so each team can deliver consistent reports that can be easily rolled up to encompass multiple areas of responsibility, or even the company as a whole, so that the CISO can clearly report your progress to the board.

Risk-based VM is the foundation of a modern security strategy

Implemented correctly, a risk-based VM strategy can help you prioritize your remediation efforts to focus first on the assets and vulnerabilities that matter most. As a result, you’ll be able to make the most efficient use of your limited security resources by reducing the greatest amount of risk with the least amount of effort. This newfound efficiency will free some of your most senior resources to work on more strategic security initiatives.

Want to learn how to put this framework into practice? Download our whitepaper, Reference Architecture: Risk-Based Vulnerability Management

Recent efforts by the U.S. Cybersecurity and Infrastructure Agency, combined with significant bills coming out of the House and Senate, are putting critical infrastructure operators on a path towards achieving cross-sector visibility and strong operational technology security.

Nearly six months ago, the global coronavirus pandemic necessitated a massive, sudden pivot to remote work. Organizations and industries that never planned to enable employees to work from home found themselves scrambling to adapt. That pivot came with cybersecurity ramifications, forcing organizations to reevaluate their threat landscape and risk environment. For critical infrastructure owners and operators in sectors such as  healthcare, communications, defense and energy the shift to remote work was particularly concerning.

For instance, during this time, the pharmaceutical industry has been hard at work to develop treatments and vaccines for COVID-19, the illness caused by the novel coronavirus — a key step towards a return to normal. But as organizations focused on this work, bad actors, foreign adversaries and criminal organizations have stepped up cyberattacks against the industry. The risks of an attack on the development, manufacture and distribution of a vaccine pose significant national security, economic and societal dangers that put the importance of secure critical infrastructure into perspective.

In the U.S., the Cybersecurity and Infrastructure Security Agency (CISA) has been working to protect federal and critical infrastructure IT systems from exploitation by malicious actors during COVID-19.  But even before the pandemic, CISA had been working to secure industrial control systems (ICS) connected to critical infrastructure, including commercial manufacturing plants. In July, CISA released its ICS Strategy, which calls for empowering and educating ICS operators to secure their operations against cyberthreats. This is key: Operators from all sectors need tools, resources and expertise to defend themselves using basic cyber hygiene and vulnerability management practices. Galvanizing the ICS community to work across sectors and with government agencies will have a tangible impact on their security posture. CISA is leading the way in that plan.

But cyber hygiene and vulnerability management aren't enough to completely mitigate today's advanced threats. We also need cross-sector visibility and strong overall OT security and collaboration to help manage threats. CISA is currently in the process of refreshing the National Infrastructure Protection Plan, which was last updated in 2013. CISA is engaging with public and private stakeholders across all critical infrastructure sectors and from all levels of government in the update to this plan. Cross sector collaboration should be a key feature in the updated plan. In the instance of grid security, electric utilities should work together, not against each other, on security. Pharmaceutical companies should be sharing best practices to keep COVID-19 vaccine information and manufacturing plants secure.

CISA has also released cybersecurity best practices through its Cyber Essentials toolkits series. The most recent release, Essential Elements: Your Systems, leads with the essential action of learning what is on your network. This inventory of hardware and software assets is crucial because an organization's security team can't effectively protect connected assets if it's unaware of their existence.

As I noted in August during a webinar with Barak Perelman, Tenable's VP of OT Security, several of the security issues for critical infrastructure industries right now stem from a lack of awareness, and many OT operators don't know where to start. These measures will help to bridge that gap.

While CISA makes important strides on OT security through the agency process, Congress is also keenly aware of the threat. The Senate is working on the American Energy Innovation Act, which contains several provisions, including the PROTECT Act, the Enhancing Grid Security through Public-Private Partnership Act and the Energy Cybersecurity Act, that would help make significant strides towards securing the electric grid and the nation's energy infrastructure. Here's a closer look at some of these recent efforts:

• The PROTECT Act, introduced by Sens. Lisa Murkowski (R-Ark.) and Joe Manchin (D-W.Va.), would establish a grant program within the Department of Energy (DOE) to help improve the cyber defenses of rural electric cooperatives — which are among our most vulnerable electric infrastructure — giving cooperatives the support they need to make vital cyber improvements. The act would also direct the Federal Energy Regulatory Commission (FERC) to use rate incentives to encourage electric utilities to invest in cybersecurity.  

• The Enhancing Grid Security through Public-Private Partnership Act, introduced by Sens. Cory Gardner (R-Colo.) and Michael Bennet (D-Colo.) in the Senate, and Reps. Jerry McNerney (D-Calif.) and Bob Latta (R-Ohio) in the House, would give DOE the authority to provide cybersecurity assistance through a public-private partnership to resource-constrained electric utilities by providing tools for self-assessment, sharing of best practices and assistance with threat assessments and training.
• The Energy Cybersecurity Act, introduced by Sens. Maria Cantwell (D-Wash.) and Martin Heinrich (D-N.M.), directs DOE to develop advanced cybersecurity applications and technologies for the energy sector through advancing the security of field devices and third-party control systems. DOE engagement with other appropriate federal agencies, the national laboratories and with industry stakeholders is a key component of this legislation.


In addition to the above measures, the House is currently considering the Clean Economy Jobs and Innovation Act, which includes cybersecurity provisions associated with electric grid modernization, smart buildings and smart manufacturing. It also incorporates cybersecurity research and development legislation sponsored by Reps. Ami Bera (D-Calif.) and Randy Weber (R-Texas), including important sections on grid resilience and vulnerability testing to improve energy sector cybersecurity.

This agency work and these aforementioned bills coming out of the House and Senate are all important and thoughtful steps towards securing the nation's energy infrastructure, but we shouldn't stop innovating and improving. For instance, energy cybersecurity legislation should require DOE to work closely with CISA on interoperable information sharing.

The American Energy Innovation Act and the Clean Economy Jobs and Innovation Act have several vital energy cybersecurity components and Congress should work quickly to further refine and pass this legislation.

As Perelman noted in our discussion last month, 15 years ago, we had to convince people that the threat to the electric grid was real. Now, Congress is taking important steps towards securing our OT infrastructure. I look forward to working with my colleagues and government partners on this important issue as industry co-chair of the Control Systems Working Group (CSWG). In this role, I'm thrilled to help develop the CSWG's strategy and work with industry and government stakeholders to implement our plans for collaboration and information sharing across sectors and fields to improve OT security and ensure we have a strong critical infrastructure foundation for years to come.

Learn more:

• View the webinar: Expert Advice - What You Need to Know: CISA/NSA Alert AA20-205A for OT Systems
• Read the blogs:
• US Cybersecurity Agency CISA Alert: Foreign Threat Actors Continue to Target Unpatched Vulnerabilities
• Why Accidental Convergence Requires Purposeful Industrial Security

Six vulnerabilities in a popular license management product put industrial control systems at risk for remote attacks.

Background

On September 8, researchers at Claroity published their detailed analysis, dubbed “License to Kill,” covering several vulnerabilities they discovered in CodeMeter. CoderMeter is a licensing software produced by Wibu-Systems designed for license management and antipiracy in industrial control systems (ICS). It has been integrated by a number of major device manufacturers in the ICS market like Siemens and Rockwell. Other vendors may also be affected as some third party vendors may integrate CodeMeter into their own solutions and devices. The vulnerabilities are significant on their own, but when chained together they provide attackers with a powerful method to attack ICS devices. On September 17, the Cybersecurity and Infrastructure Security Agency (CISA) further reinforced the seriousness of the vulnerabilities, releasing an ICS Advisory (ICSA-20-203-01).

Analysis

The six vulnerabilities discovered in CodeMeter each relate to individual components of the software. Our analysis focuses on the specific vulnerabilities and chaining of these flaws required to perform an attack on a vulnerable system.

To initiate an attack chain for control of devices managed by vulnerable versions of CodeMeter, an attacker would need to forge a license file (CVE-2020-14515) so that CodeMeter trusts the malicious payload that it will later receive. This is achievable because vulnerable versions of CodeMeter do not contain a chain-of-trust check for license files.

A malicious license file with a topic element set to a length of 0 will cause CodeMeter to hang in an endless loop while it tries to parse the file, thereby creating a denial of service (DoS) condition (CVE-2020-14513). This, however, ends one branch of a potential attack chain, and does not lead to a remote code execution (RCE) attack.

The researchers then found that any authorized client connected back to the CodeMeter server had unrestricted access to all functions through the CodeMeter API. However, an attacker cannot force client authorization, so a user would need to somehow accidentally authorize a malicious client with a forged license, which would then allow an attacker to gain code execution on the CodeMeter server and its connected devices (CVE-2020-14509).

CVE-2020-14519 is another code execution flaw, but unrelated to the license manipulation attack chain. This attack requires host access to the CodeMeter server in order to work. By running a malicious application on the CodeMeter server host operating system, an attacker can attack the local loopback listening port for the CodeMeter API (IP 127.0.0.1) and gain full control of the CodeMeter server. In order to exploit this flaw, the attacker would need to trick a user into running a specially crafted JavaScript payload on the CodeMeter host, or execute the payload themselves if they’ve gained system access through other means. The attacker can potentially deliver this payload through a user’s web browser by convincing them to visit a malicious website from the CodeMeter server host. This vulnerability could also be chained with CVE-2020-14515 to create or alter license files for CmActLicense using CmActLicense Firm Code.

Visualization of the CVE-2020-14519 attack chain

Image Source: Claroty

Below is a list of all six vulnerabilities that were disclosed along with their CVSSv3 and Tenable VPR scores.

*Please note Tenable VPR scores are calculated nightly. This blog post was published on September 28 and reflects VPR at that time.

Solution

Wibu-Systems released fixes for all six flaws and recommends upgrading to version 7.10 of CodeMeter. Users are encouraged to upgrade as soon as possible. Much like the Ripple20 vulnerabilities, however, these flaws in CodeMeter present large-scale patch management challenges for vulnerable servers and clients. CodeMeter users can patch their CodeMeter servers, but clients may require vendor intervention and patching. Detection and assessment are key to mitigating risk. We encourage users to manually check for devices like CodeMeter USB dongles in their environment, as device vendors may require additional updates, or issuance of new devices.

If upgrading is not feasible at this time, the mitigations suggested are to block external access to TCP port 22350 to prevent access to the CodeMeter network protocol. However, if an attacker already has local network access via a different vulnerability, they would still be able to exploit CVE-2020-14519.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability is available here.

Tenable.ot customers should contact their Customer Success Manager (CSM) to get access to Suricata rules that can be used for detection. These rules will be fully integrated into the next service pack of the current release and later versions.

Get more information

• CISA Alert for License to Kill
• Claroty Advisory

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Independent business risk study shows when security and the business are aligned around agreed-upon contextual data, they deliver demonstrable results. Here's how to get there.

Folks, cybersecurity is broken. Security leaders are drowning in data. We can tell you how many vulnerabilities there are. We can tell you how many patches we've deployed. We can recite chapter and verse on the latest threats. Yet, with all this information at our disposal, most of us struggle to answer the question “How secure, or at risk, are we?" with a high degree of confidence.

Why? Because we're missing one key piece of information: business context.

The typical equation we use to calculate an organization's level of security or risk is a function of  assets, security controls, threats and vulnerabilities. Without business context — understanding which assets are most critical to the core value proposition of your business and which security controls are in effect for each of those assets — the results of any security risk calculations are incomplete, at best.

But security leaders can't arrive at an understanding of business context by working in a silo. It requires a level of strategic alignment between business and cybersecurity leaders that is lacking in most organizations. Indeed, a commissioned study conducted by Forrester Consulting on behalf of Tenable shows significant disconnect between business and security. According to the study, which is based on a survey of 416 security and 425 business executives, just 54% of security leaders and 42% of business executives say their cybersecurity strategies are completely or closely aligned with business goals. Less than half of security leaders surveyed say they consult business leaders with a high level of frequency when developing their cybersecurity strategy. Even worse, four out of 10 business executives rarely — if ever — consult with security leaders when developing their organizations' business strategies.

"The biggest challenge may be to make business owners get interested and understand that they should be the ones owning cybersecurity risks," said Jose Maria Labernia Salvador, head of IT security and internal control at LafargeHolcim IT EMEA in Madrid, in an interview with Tenable. “Cybersecurity is a business-related topic with a strong IT component. IT can support and guide, but business stakeholders and senior management are a core component in the equation."

The Forrester study shows that when business and security are aligned, they deliver demonstrable results. For example, business-aligned security leaders are:

• Prepared to report on security and risk. The business-aligned security leader is eight times as likely as their more siloed peers to be highly confident in their ability to report on their organizations' level of security or risk.
• Ready to show ROI on their security initiatives. The vast majority of business-aligned security leaders (85%) have metrics to track cybersecurity ROI and impact on business performance compared with just 25% of their more reactive and siloed peers.
• Equipped with a defined benchmarking process. Nearly nine out of 10 business-aligned security leaders (86%) have a process that clearly articulates expectations and demonstrates continuous process improvement relative to peer companies and/or internal groups. Only 32% of their non-aligned peers can say the same.

That's not to say responsibility for achieving alignment falls squarely on the shoulders of the security leader. Some organizations are culturally inclined to create silos. No matter how much effort you put into it, if you work for one of these organizations you may always struggle to align with your business counterparts.

If you're not sure where your organization falls on the alignment continuum, there's one quick way to tell: If you have an executive with the title of Business Information Security Officer then your organization falls on the more mature end of the alignment scale. According to the Forrester study, the vast majority of business-aligned organizations (80%) have a Business Information Security Officer (BISO) or similar title, compared with only 35% of their less-aligned counterparts.

How to become a business-aligned cybersecurity leader

If you're lucky enough to work for an organization where the business-cyber alignment is already relatively mature, then your path to becoming a business-aligned security leader will be fairly clear, even if it does require considerable effort to navigate. But if you happen to work for an organization on the lower end of the alignment-maturity scale, your journey will be far more challenging. Since there's no one-size-fits-all approach, I've tailored the following guidelines with three options, based on level of alignment maturity, in hopes that one of these options will present a starting place that works for you.

Five steps to improve alignment with your business stakeholders at each level of organizational maturity

Source: Tenable, September 2020

Regardless of where your organization falls on the alignment-maturity continuum, you'll do well to follow the advice of Kevin Kerr, CISO of Oak Ridge National Laboratory in Oak Ridge, TN. In an interview with Tenable, Kerr advised:  "The CISO news to get out from behind their desk and walk around. Talk to people. Learn people's concerns and objectives at the various levels — bottom to top. Understand what's going on. Don't listen only to your IT people, because they're jaded from their IT point of view. Go see what's going on from the business point of view and listen." Of course, in the current COVID-19 pandemic you may have to perform such a walkabout virtually. But whether it's done face-to-face or via Zoom, the effort will benefit your organization and your career. "It gets your name around," said Kerr. “If people know you're there to help them figure out the best way to do what they want while still protecting the organization, they'll welcome your participation. I never want to be the 'no' in 'innovate.' "

Becoming a business-aligned cybersecurity leader is a marathon, not a sprint. It requires learning how to speak the languages of business and technology with equal fluency. But, as the Forrester study notes, “modern security threats require a new approach." The future belongs to the security leaders who are ready to manage cybersecurity as a business risk.

Previous blogs in this series focused on the challenges of aligning cybersecurity and business and why cybersecurity leaders struggle to answer the question “how secure, or at risk, are we?". We also examined what COVID-19 response strategies reveal about the business-cyber disconnect and considered why existing cybersecurity metrics fall short when CISOs need to communicate with executives and the board. In an upcoming post, we'll spend a day in the life of a business-aligned security leader.

Learn more:

• See additional study highlights here
• Download the full study, The Rise of the Business-Aligned Security Executive
• Read the blogs
  • Aligning Cybersecurity and the Business: Nobody Said It Was Easy

  • Why Cybersecurity Leaders Struggle to Answer the Question ‘How Secure Are We?'
  • What COVID-19 Response Strategies Reveal About the Business-Cyber Disconnect
  • Communicating Business Risk: Why Existing Cybersecurity Metrics Fall Short
• Download the white paper, What It Takes to Be a Business-Aligned Cybersecurity Leader
• Read the eBook, How to Become a Business-Aligned Security Leader
• Listen to the Cyber Exposure Podcast series, "Interview with Tenable CSO Bob Huber"
• View the webinar, The Rise of the Business-Aligned Security Executive

With the increasing use of chatbots as a frontline tool for businesses, organizations need to take a closer look at the security of such services and include them in their threat model.

Chatbots, such as those provided by Drift, Freshworks, Bold360, and others are easily the best internet phenomena since “We use cookies” popups. Chatbots are difficult to avoid. Despite the occasional annoyance, the fact is they're highly effective and efficient tools for many sales and support teams around the globe. They also happen to be a potential security gap often overlooked by many organizations.

How do Chatbots work?

Today’s chatbots serve a variety of purposes. They’re great at:

• Generating sales leads
• Answering common support questions
• Redirecting site visitors to other resources or contacts

That said, these bots can't do everything, so at some point, a human has to get involved. Many interactions can be handled directly through the chat service provided by the bot, such as a support person walking a customer through some common troubleshooting steps. In more complex situations, however, these bots will often schedule meetings or send messages to be handled outside of the chat session. For example, if a prospective customer wants to chat with a salesperson about terms for a potential deal, they'll have a quick back and forth with the bot, which will result in a meeting with a salesperson being scheduled. How does this work? Well, this is where the security gap comes in.

Security Impact

Companies are finding more ways to integrate these bots into their existing business models. These bot services have functionality built-in that gives them permission to schedule meetings and send messages as an individual from a given pool of users. These meeting invites and emails will appear to come directly from these individuals and not from a third party service. In some cases, these chatbots may need to collect personally identifiable information (PII) or payment information. This creates additional risk and raises several security concerns around data collected.

Let’s first consider the impacts of collecting PII. Organizations need to be cautious in understanding how the chatbot platform integrates with their business. Understanding if the chatbot requires privileged access to backend systems for authentication or account authorization is a major security concern. Additionally, one has to consider if the traffic is encrypted, how information is stored and equally important and how the chats are logged. If an attacker were able to identify a vulnerability in a chatbot application, this could open an opportunity to access privileged and possibly sensitive data. If the data collected is only stored with the chatbot service provider, there’s the added risk of not being able to control how that data is secured or stored, both in transit and at rest. In 2018, Sears and Delta suffered a breach of payment data when a third party chatbot service they utilized was compromised.

Additional concerns arise in cases where the chatbot is used as a scheduling mechanism. In a best-case scenario, this causes nothing more than minor annoyance and embarrassment. In others, the consequences could be much more severe. An attacker could launch advanced social engineering attacks by essentially sending messages as a trusted insider for the company using the chatbot service.

As an example of an attack Tenable has previously observed in the wild, let’s say your company uses a chatbot service on their site to generate sales leads. If an attacker happens to know or guess the email addressing scheme or internal mailing lists the company uses (such as all-hands@example.com), they could send messages on behalf of a salesperson to anyone within the organization. In the example below, the meeting notes section of a calendar invite could include any message an attacker wanted, even one containing malicious links. This email appears as a trusted source and is not marked as coming from the outside world -- effectively bypassing all existing email protections, such as DomainKeys Identified Mail (DKIM). As the author appears to be a trusted source, employees would be more likely to follow the malicious link in the invite.

While this example is not a major breach of security, it does demonstrate how one of these chatbot services can be abused. What happens if the attacker starts filing IT requests on behalf of a salesperson? A sophisticated attacker with malicious intent could wreak havoc by abusing the functionality provided by the bot, perhaps by requesting ports to be opened on the company firewall or applications/services to be installed.

Solutions and best practices

As chatbot use and scope of services continues to expand, the following solutions and best practices can help increase security and reduce an organization's risk:

• Authentication: In scenarios where your chatbot needs to authenticate a user in order to provide specific solutions or fulfill requests, it is imperative to consider how the user will authenticate and how the chatbot system will handle these requests. Using two-factor authentication (2FA) adds an additional layer of security and if using a third-party chatbot service, single sign-on (SSO) solutions may be available and should be utilized. Additional consideration around authentication should include forcing timeouts after a set time period.
• Encryption: While end-to-end encryption might seem like overkill for basic support questions, encrypting all traffic could help protect vulnerable users. Consider a use-case where a customer using public WiFi enters their account information and password in their query to the chatbot without being solicited for this information.
• Logging: Careful consideration must be made in what data is collected and how this data is stored. There may be international laws to consider based on a user's geographic location, but also consider the above example, where a user inputs their username and password into the chat. One solution might be to delete all chat data once the session is complete or closed due to a time out condition. Other solutions might include matching specific keywords to scrub out any sensitive data from logs.

The easy solution in this scenario would be to simply blocklist or deny your own company from being able to receive these messages, which is not a default behavior or configuration for many of these services. This mitigation doesn't, however, prevent an attacker from sending these unsolicited messages to third-parties. Other solutions could include forcing these messages to come from a separate, designated domain and ensuring that no internal processes rely strictly on email. These solutions would allow more flexible monitoring and filtering.

Conclusion

The risks involved with chatbot attacks are likely to be more of an annoyance than anything else. Depending on a company’s configuration, sophisticated social engineering attacks could definitely occur, but to our knowledge at the time of this writing, social engineering hasn't been the sole cause of any major breaches. Despite the current risk profile for chatbots, it's still something security organizations within companies should be paying closer attention to and monitoring. It certainly isn't the type of attack we see everyday, and chatbots are a pretty innocuous piece of software that most people don't realize wields this sort of power. However, we believe it’s important to take a closer look at the chatbots your organizations utilize and make sure it's included in your threat models.

Get more information

• Chatbot Provider Hack Hits Delta, Sears

See vulnerabilities reported to vendors from Tenable's Research Teams on the Tenable Research Advisories page.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

There's plenty you can do during Nessus Professional's free trial period to experience the strength of the No. 1 vulnerability assessment platform. 

It's not always easy to know what to make of free trials, and software in particular can sometimes be so limited in trial mode that it is hard to get a sense of what the full version can do. 

But that isn't the case with Nessus Professional. Registering for a free trial of the No. 1 vulnerability scanning and assessment solution allows you to experience many of its key features – including dynamic vulnerability scanning and the always-on coverage of Live Results. In this post we'll take an in-depth look at what you can do with Nessus during your trial to get the most out of your evaluation.

Getting started: Tenable Community

Beginning your Nessus Professional trial requires creating a Tenable Community account before you install the software. Why is this important? Simple – the Tenable Community is your one stop for product management and helpful resources and information. In your account, you can manage your trial and purchases, report problems and request product enhancements. You'll also have the ability to interact directly with other Nessus users as you navigate the product during your seven days of free use. If you have any issues with the first few scans, or simply want to know more about certain processes, you can search the Topic Library or post a question to ask other members. You can also access a variety of help resources, including webinars, blog posts, product documents and more. (Don’t forget to check out the Nessus Professional Trial Guide, which can help you get up to speed quickly.)

The Community forums are divided into dedicated sections. You'll likely find the following most helpful early on: Install & Orchestration, Configuration, Reports, Dashboards & Templates, Licensing and Asset Scanning & Monitoring. 

Scanning as a trial user

Once you have activated your Nessus trial with the activation code from your Community account and downloaded the product, set up an administrator login and take a bit of time to get familiar with the program's interface. Then, you're ready to start your first vulnerability assessment. 

Navigating to the Scans page from the top bar, click the New Scan button and choose a scan template, also known as a policy. Many of the pre-built templates included in the program's full version are available in the trial. From there, you can:

• Conduct basic scans of your entire network
• Look for infamous vulnerabilities and malware, such as DROWN, WannaCry, Spectre and Meltdown, with scan templates specifically designed for critical vulnerabilities
• Target scans to search for vulnerabilities in specific applications, hosts or network areas
• Find unpatched software within your hosts

We generally recommend that users go with the most straightforward templates, like Basic Network Scan, while working with Nessus during the trial period. But if you're experienced with information security, don't feel like you have to limit yourself. Additionally, you can adjust the configurations of pre-built policies before you initiate a scan. In fact, we typically advise that you check the configuration settings so that there aren't any issues with your system's environment. Specifically, review settings in the Discovery, Assessment, Report and Advanced categories. 

Last but not least, hit Launch Scan. Keep in mind that this process will take some time, so it will be best if you run your trial scans outside regular business hours or at another time when network activity and congestion are particularly low. Additionally, while you can conduct as many vulnerability scans as you want during the seven days of your trial, keep in mind that you're limited to assessing 32 IPs until you have a full Nessus license.

Key features to demo

Some functions of Nessus included in your trial version are features that the software's users often rave about. Take a look:

• Credentialed scanning: A vast majority of vulnerabilities can't be detected unless you conduct a credentialed scan. In this mode, Nessus can have all the permissions of an administrator or root user – or any other set of privileges you deem appropriate – and fully examine any area of the network. Set credentials up to your liking as part of initial scan configuration. 
• Dynamic vulnerability scanning: With this feature, you can set up a vulnerability scan template focused on hyper-specific points of potential risk, such as CVEs included in recent Microsoft Knowledge Base advisories, or flaws within Java-based applications. Create your dynamic filters by selecting plugin attributes you wish to monitor, and pertinent plugins will be automatically added to your policy as Tenable releases them. 
• Live Results: Every time there's a plugin update, this feature performs an offline vulnerability assessment by looking at historical scan data, without slowing down other network operations. If you have an infrequent or inconsistent scan schedule, Live Results covers you by alerting you to potential issues in real time.

Making the case for Nessus

Your trial scan will offer an actionable assessment of vulnerabilities and weaknesses throughout your network. Once it's complete, you can create reports that outline those scans' results, which will be helpful in persuading other organizational stakeholders of Nessus' value. Reports are exportable in simple HTML or PDF formats, and you can customize them to be as comprehensive or succinct as you see fit.

While you can't harness the full potential of Nessus Professional during the trial, the breadth of things you can do will help you complete a full evaluation. Get yourself a head start on leveraging Tenable's widely acclaimed vulnerability scanning solution today.

Start Your Free 7-Day Trial

Supporting remote engineering teams requires intentional efforts to spur social engagement and make it easier for employees to unplug from work. Here are some tactics your team can use to drive healthier collaboration.

Cohesion is an important attribute of all successful engineering teams. While coding may require more individualized focus than other roles, building and shipping successful product capabilities is always a team effort. Organizational research from MIT shows that group cohesion is a key predictor of team productivity, and in the COVID-19 era, maintaining that edge means finding creative ways to replace normal in-office social interactions with online equivalents.

Fortunately, Tenable has experience supporting a large, distributed workforce. In fact, more than half of Tenable engineers around the globe were already working remotely before the pandemic. For previously co-located teams, including mine at Tenable HQ, we used this foundation to adapt the ways in which we used to collaborate. These are a few tricks we’ve learned that can help strengthen social ties during this difficult time.

Break up coding sprints with a breath of fresh air

Self-care is critical for engineers, who often face high demands and the risk of burnout in their work. In the latest Buffer State of Remote report, engineers comprised the largest respondent cohort, and their two most commonly cited challenges were “unplugging” and “loneliness.” Although many software engineers who identify as introverts may find some comfort in remote work, there’s no denying that the situation requires compensating efforts to combat the potential isolating effects.

One way we’ve addressed this challenge within Tenable Engineering is by updating a favorite activity. Prior to COVID-19, members of the HQ engineering team often recovered from a long coding session or a day filled with meetings by going outside for walks around the building. We used the time to mentally unwind and talk with teammates about non-work-related matters. Eventually, we gave this activity the name “sanity walks,” and in addition to making us feel better, they also strengthened interpersonal bonds across the team.

While coding from home full-time makes it challenging to maintain these informal conversations, we found a workaround: the “sanity Zoom.” Instead of dropping by a colleague’s cubicle, we Slack each other anytime we need a break, then set out to explore our own neighborhood trail while connected to a team member via the Zoom smartphone app. It’s not a perfect substitute for face-to-face contact, but the versatility of the internet offers us the ability to socialize and help each other restore our mental energies, even while working remotely. 

Virtual coffee chats encourage lateral knowledge sharing

Key to Silicon Valley lore is the idea that the proverbial water cooler can spark creative ideas and innovative solutions. In the era of remote work, technology teams must intentionally design opportunities for serendipitous encounters. 

At Tenable, long before the pandemic, we started a “Coffee Buddies” program to foster more connections between our large remote workforce. Interested individuals across the company can join a common Slack channel to meet with others for an impromptu chat. The program randomly pairs you up with someone every two weeks, and then you both find a time to meet over Zoom. If the two individuals happen to work at the same local office, and social distancing policies allow, they might meet in person for a donut and coffee.

These pairings are not binding commitments. I’ve been guilty of not finding a time to meet during some of my busy coding sprints. But the loosely structured hangout gives Tenable employees the ability to socialize with colleagues they may never have gotten to meet or interact with otherwise. These benefits extend back into the work sphere. Colleagues with whom I’ve been randomly paired with have ended up becoming points of contact for engineering questions and subject matter expertise. For instance, as a back-end developer, I tend to be isolated from UX or UI design teams; but after meeting up with a new UX hire via the Coffee Buddies program, I now have a trustworthy point of contact for future questions about my product.

Streaming parties capture the fun of group outings

Never underestimate the power of a board game to bring your team together. For all of the attention on remote work in recent years, roughly two-thirds of remote employees still report a critical lack of team-building sessions. 

In addition to video chats, we’re fortunate to have a number of digital technologies to help us alleviate the effects of social distancing. Apps like Netflix Party, a Chrome extension, allow you to watch a Netflix show with your friends, synchronized at the same timestamp for all partygoers so everyone’s watching it together regardless of time zone. A similar app exists for virtual reality enthusiasts: BigScreen for Oculus allows you to virtually hang out as avatars in a giant personal home theater, watch movies with your teammates and play games together. Some members of the Tenable Engineering team have already met up via Zoom during weekends and used these tools to watch movies together (by the way, re-watching the entire Lord of the Rings trilogy with a co-worker in one day is a fantastic experience).

Constructive socialization in the workplace has never been more important, and Tenable does a great job fostering this without it being forced upon us. The benefits should not be understated. Our team has seen a boost in participation. Colleagues frequently mention how much they look forward to our weekly Friday lunch Zoom calls. There’s less tension and stress since we have dedicated time for all of us to relax, thus boosting our collective morale. I’ve seen many of my colleagues join these events or activities just to listen, which is totally fine and equally awesome, because even for introverts like me, sometimes it’s absolutely necessary to crack open a cold Zoom call with your colleagues and chill.

Learn more

• Read our blog on "Coding from Home: 6 Simple Hacks for Boosting Your Productivity"
• Visit our Tenable Careers page and view our open engineering positions

Armed with these new capabilities, Tenable users will be equipped to see everything, predict what matters most and act to address cyber risk so they can effectively align their cybersecurity initiatives with business objectives. 

"How secure are we?"

It sounds like a simple question, but security pros know arriving at an accurate answer is anything but simple. For example, consider the following:

• Only 53% of all organizations have a holistic understanding of their attack surface.¹
• On average, an enterprise must address more than 870 vulnerabilities impacting 960 assets — each and every day.²
• Fewer than half of security leaders can frame the impact of cybersecurity threats within the context of a specific business risk.¹

Calculating and communicating cyber risks in a language that non-technical business leaders can understand is hard. And it becomes even more difficult when your attack surface dramatically expands. Digital transformation and the current work-from-home economy have converged to cause a surge in new and different types of assets connecting to your organization — a trend that is likely to continue for the foreseeable future. This is the challenge we at Tenable are working to solve to help you align your cybersecurity initiatives with core business objectives.

Our vision? To take you beyond traditional vulnerability management with a Cyber Exposure Management platform that enables you to see and continuously assess your modern attack surface, predict which vulnerabilities pose the greatest business risk and act with confidence to effectively reduce risk. The ability to see, predict and act are foundational to a strong Cyber Exposure Management practice.

Today, we announce a series of new and exciting capabilities to help you better manage, measure and reduce cyber risk across your modern environments. Taken together, these new capabilities represent the three core pillars of our Cyber Exposure Management platform.

See Everything

Achieving visibility across your entire attack surface is job No. 1 for cybersecurity professionals. There are many good reasons why asset inventory and assessment are at the top of many security frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Center for Internet Security (CIS) Controls. It's critical for you to be able to discover and assess all assets across your attack surface, including cloud instances and operational technologies (OT). New SEE capabilities include:

• Frictionless Assessment for Amazon Web Services (AWS). Over the past 20 years, Tenable has pioneered both active scanning with Nessus and passive monitoring with Nessus Network Monitoring to provide the most comprehensive view inside your organization. Now, we have unveiled Frictionless Assessment, which is a groundbreaking approach to analyzing cloud assets without the need to deploy scanners, agents or any other software. This new sensor technology uses cloud-native services to continuously maintain inventories and reassess instances without interruption. You can gain visibility into your exposures as new vulnerabilities are published and your cloud environment changes, all without having to manage scan schedules, credentials or agents. Frictionless Assessment will be available in Tenable.io later this quarter and will support AWS EC2 instances at launch.
• Tenable.ot Integration for Tenable.io. Tenable.io now fully supports Tenable.ot to deliver unified visibility, security and control of converged and distributed IT/OT environments. As cloud becomes a more attractive, efficient and cost effective way of securing OT environments, Tenable.io users can obtain a single view of security issues for all IT, cloud, web app and OT vulnerabilities — and deliver relevant information to the right stakeholders at the right time. You can also take advantage of pre-configured dashboards to provide a complete picture of OT cyber risk. This integration is available today.


Predict What Matters

Security teams are overwhelmed by vulnerabilities. It doesn't help that vulnerability prioritization processes based on the Common Vulnerability Scoring System (CVSS) rate more than half of all new vulnerabilities as high or critical severity. Yet, Tenable Research finds that public exploits are available for only 7% of these Common Vulnerabilities and Exposures (CVEs) and only a fraction are used in attacks. Threat intelligence coupled with business context and data science can help you anticipate which vulnerabilities are most likely to be exploited on which assets. New PREDICT capabilities include:

• Exposure.ai. As the foundation to Tenable's predictive technologies, Exposure.ai continuously analyzes more than 20 trillion aspects of threat, vulnerability and asset information using machine learning algorithms to predict critical exposure points before they can be leveraged in an attack. Exposure.ai powers Predictive Prioritization (introduced in 2019) and Predictive Scoring (detailed below) to help you focus on the security issues that matter most. Exposure.ai is available today and powers Tenable.io, Tenable.sc, Tenable.ot and Tenable Lumin.
• Predictive Scoring. One of the key challenges facing security professionals is finding a way to obtain a richer set of data from assets for which they lack admin credentials, either due to operational challenges or organizational silos. While the simple answer to this problem is for an organization to mandate 100% authenticated scan coverage, the reality is that many types of assets cannot be assessed with credentials or even with local agents. In fact, according to Tenable Research, security organizations have credentials for only 40% of the assets they scan. This creates a visibility gap, as unauthenticated scans can examine only publicly visible information and are unable to provide detailed information about assets. Tenable Research reveals that authenticated scans detect 45x more vulnerabilities than external, unauthenticated scans. To solve this visibility gap, Predictive Scoring infers the potential exposure of assets assessed by unauthenticated scans. How does it do this? By leveraging the Exposure.ai data lake to identify similar assets assessed by authenticated scans based on OS, device type and open ports detected, and by using machine learning algorithms to evaluate the criticality of vulnerabilities found on those similar assets. This helps to guide security teams to identify and improve visibility to areas of potentially high risk. Predictive Scoring will be available in Tenable Lumin later this quarter.

Act to Address Risk

Once you know and prioritize your exposures, you have to take action. This means deciding whether to remediate or mitigate if remediation isn't an option. But don't forget about maturing your overall processes to identify any shortcomings or gaps in your security hygiene to drive improvement. Peer benchmarking and the ability to communicate cyber risk in a clear and concise language is essential. New ACT capabilities include:

• Remediation Maturity. Timely remediation of high risk and critical security issues is a differentiating attribute of security organizations. Attackers have a seven-day window to exploit a vulnerability before a defender is even aware they are vulnerable, so security teams need to step up their game. Remediation Maturity is a new capability in Tenable Lumin that helps you measure the speed and efficiency of remediating vulnerabilities and compares your process maturity against external peers and Tenable best practices. The combination of Assessment Maturity (measuring the frequency and depth of your assessments) coupled with Remediation Maturity is a real game-changer for security teams looking to optimize their processes. Remediation Maturity is available in Tenable Lumin today.
• Mitigations. For some assets, timely remediation of security issues may not be possible. For others, remediation might be too costly or break service-level agreements. Mitigations is a new capability in Tenable Lumin to help you evaluate alternatives to remediations. It provides an inventory showing which of your assets have endpoint security controls so you have a more complete and accurate picture of your exposure and helps you understand whether mitigating controls are deployed and operating as expected. Mitigations will be available in Tenable Lumin later this quarter.

Take the Next Step

We will be discussing these and many other exciting capabilities at EDGE WEEK 2020, October 5-9. Register now for an entire week of cybersecurity thought leadership, original research and hands-on training. I hope you will join us!

In addition, please reserve your spot now for our upcoming webinar, "See, Predict, Act: Innovative Approaches for Overcoming Cyber Risk," at 2:00pm ET on October 28, where we will be providing a more in-depth overview and demo of each of the new capabilities discussed today. Looking forward to seeing you there! In the meantime, check out this page to learn more about this exciting launch.

¹ "The Rise of the Business-Aligned Security Executive," a commissioned study conducted by Forrester Consulting on behalf of Tenable, August 2020. Base: 416 security leaders with responsibility over cybersecurity/security strategy and budgets. 

² "Vulnerability Intelligence Report," Tenable Research, November 2018.

Vulnerabilities in HP Device Manager could be chained to achieve unauthenticated remote command execution.

Background

On September 25, HP published a security bulletin to address multiple vulnerabilities in HP Device Manager, software that’s used to remotely manage HP Thin Clients. The vulnerabilities were disclosed to HP by security researcher Nick Bloor. As part of a Twitter thread, Bloor warned that a combination of these vulnerabilities would result in “unauthenticated remote command execution as SYSTEM.” On October 5, Bloor published a blog post detailing his findings.

Hey @TheRegister, a HP developer put a backdoor database user account in HP Device Manager which is used to manage HP thin clients. Combined with some other vulnerabilities this leads to unauthenticated remote command execution as SYSTEM.

— Nicky Bloor (@nickstadb) September 29, 2020

There were three vulnerabilities in HP’s security bulletin and the table below lists the assigned CVE identifiers and CVSSv3 scores:

Analysis

CVE-2020-6925 is a weak cipher implementation vulnerability, which means dictionary attacks may be possible against locally managed accounts in the HP Device Manager. HP notes that this vulnerability is mitigated by the use of Active Directory authenticated accounts.

According to Bloor’s research, the HP Device Manager server’s Remote Method Invocation (RMI) service method, ServGetUsers(), will return a list of accounts and their associated hashed passwords (using MD5 hashing algorithm). Bloor states that these password hashes were “salted using a static hard-coded salt.”

Example of the weak cipher implementation using MD5 encryption and static salt Image Source: Nick Bloor’s blog post

MD5 hashes have been deemed unsuitable for years. Since 2009, the CERT Coordination Center has advised against the use of MD5, saying it “should be considered cryptographically broken and unsuitable for further use.”

CVE-2020-6926 is an RMI vulnerability that would allow a remote, unauthenticated attacker to gain access to resources in the HP Device Manager. This vulnerability received a CVSSv3 score of 9.9, the highest of the three vulnerabilities disclosed.

Bloor found that he could inject database queries into the RMI service. Specifically, he identified that the HP Device Manager uses Hibernate, one of several object-relational mapping frameworks. Hibernate offers its own query language, known as HQL. Bloor managed to smuggle Postgres injection payloads through HQL in order to overwrite the Postgres host-based authentication configuration file (pg_hba.conf) to enable remote authentication. By default, remote authentication is disabled.

CVE-2020-6927 is an elevation of privilege vulnerability in HP Device Manager. According to HP, this vulnerability is mitigated when the integrated Postgres service has not been installed and with the use of an external database, such as Microsoft SQL Server.

During his research, Bloor discovered in the HP Device Manager database (hpdmdb) the presence of a backdoor user account, dm_postgres, which has superuser privileges.

PSA: Do you or your clients use HP thin clients and manage them with HP Device Manager? I strongly advise you, firstly, to log on to all servers running HP Device Manager and set a strong password for the "dm_postgres" user of the "hpdmdb" Postgres database on TCP port 40006 1/4

— Nicky Bloor (@nickstadb) September 29, 2020

He was able to crack the password for the dm_postgres user account, which turned out to be a single space (“ “) character.

Chaining vulnerabilities to achieve remote command execution as SYSTEM

For full exploitation, an attacker would need to chain both CVE-2020-6926 and CVE-2020-6927 together.

Utilizing CVE-2020-6926, an attacker can enable remote authentication on the vulnerable HP Device Manager. With CVE-2020-6927, knowing that the dm_postgres user exists within the default installation of Postgres on HP Device Manager, an attacker could authenticate to the database using this account to elevate privileges and execute commands as SYSTEM. Bloor was able to showcase this in the example below by creating a table in the Postgres database to store command outputs that would be executed using a specially crafted query in the context of the Postgres database (SYSTEM). The output from the query results would be written back to the table which could then be retrieved with an additional query.

Example of chaining together two vulnerabilities to gain command execution as SYSTEMImage Source: Nick Bloor’s blog post

Proof of concept

At the time this blog post was published, no proof-of-concept (PoC) was available for any of these vulnerabilities. However, Bloor published a blog post containing details about his findings along with a list of steps required in order to exploit the flaw.

The gory details of the HP Device Manager vulnerabilities: https://t.co/UjaVRxu5Og

— Nicky Bloor (@nickstadb) October 5, 2020

Solution

According to HP, two of the three vulnerabilities (CVE-2020-6925, CVE-2020-6926) affect all versions of HP Device Manager.

HP released a fix for the HP Device Manager 5.0.x branch release.

While a fix has not been made available for the HP Device Manager 4.7.x release branch, HP anticipates that the fix will arrive in HP Device Manager 4.7 Service Pack 13. We will update this blog once this version becomes available.

If upgrading is not yet feasible at this time, HP suggests applying the following partial mitigations:

1. Restrict access to port 1099, 40002 to trusted hosts or localhost
2. Change the password for the “dm_postgres” account through the Configuration Manager
3. Limit access to port 40006 (Postgres) to localhost only through the Windows Firewall
4. Alternatively, remove the “dm_postgres” account from the database altogether

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

The Security Response Team would like to thank Nick Bloor for sharing details with us regarding his findings so that we could develop additional plugins to better protect our customers.

Get more information

• HP Security Bulletin for Device Manager Vulnerabilities
• Nick Bloor's Blog Post for HP Device Manager Vulnerabilities
• Twitter Thread from Researcher Nick Bloor on HP Device Manager Vulnerabilities

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.