High-performing cybersecurity teams base their actions and investments on actual risk to the business — not theoretical scores or news headlines. 

If you're like most cybersecurity professionals I talk to, you're likely buried with more vulnerabilities than you can possibly handle, so you can't keep up with your organization's policies and service-level agreements (SLAs). You also likely have blind spots across some of the most dynamic areas of your network, including cloud assets, operational technology (OT) and web apps, leaving them vulnerable to attack.

If so, there's a Gartner research report that I think you'll find valuable: The Essential Elements of Effective Vulnerability Management.¹

If you think about it, it's no secret that vulnerability management (VM) has become significantly more challenging over the past several years, for a variety of reasons:

• There's been a nearly threefold increase in the number of new vulnerabilities discovered each year since 2016
• The attack surface proceeds to expand beyond the means of legacy scanners, which weren't built for today's modern network environments 
• Most organizations have historically relied upon the Common Vulnerability Scoring System (CVSS) to prioritize their remediation efforts, but these theoretical scores lack the real-world context required to effectively prioritize what matters most

Vulnerability management, infrastructure and operations and application teams can solve this challenge by taking a risk-based approach to vulnerability management, enabling them to focus on the vulnerabilities and assets that matter most, so they can address the organization's risk instead of wasting their valuable time on vulnerabilities that have a low likelihood of being exploited.

Evolving to a risk-based approach requires several steps across a comprehensive lifecycle. These steps are:

1. Discover: Determine and prioritize your business-critical services and applications, identifying service and application owners and other stakeholders, and establishing and evaluating existing security and applicable IT policies and processes. 
2. Assess: Commit to a rigorous scanning program. You can't effectively defend what you can't see, so you have to regularly scan as much of your network as possible to eliminate critical blind spots. That means the breadth of scanning, as well as the frequency. Many organizations employing legacy VM methods scan monthly or less frequently. As a result, they're basing their remediation decisions on old, outdated information. 
3. Prioritize: Understand your vulnerabilities in the context of business risk and use that data to prioritize your team's efforts, so you can focus on the vulnerabilities and assets that matter most. You'll need a vulnerability management platform that's capable of analyzing vulnerability data together with other essential contextual elements, such as asset criticality, threat intelligence or exploit availability. Of course, that means significantly more data to analyze — which simply isn't practical to do on your own. So your VM platform will need to employ automation and machine learning, so it's capable of rendering an accurate decision right away.
4. Remediate: Don't try to remediate everything. First, determine if remediation is feasible, or if mitigation factors are needed to reduce or neutralize the threat exposure. If a low-severity vulnerability is on a non-critical asset, or remediation runs the risk of breaking critical processes, you may choose to accept the risk and take no action at all. When you do remediate, get agreement on your response plan before you take any action. And once you perform the remediation, validate its effectiveness before moving on to the next vulnerability.
5. Measure: Develop a rich set of reporting and analysis tools to effectively communicate your team's efficiency, and gain and maintain management's confidence in your abilities. Once you have the right tools, work with the various security groups throughout your organization to develop common dashboards to ensure consistent reporting. 

Taking a risk-based approach to vulnerability management dramatically improves your team's efficiency and effectiveness by allowing you to focus on the vulnerabilities and assets that matter most. By cutting through the noise of every vulnerability across your attack surface and honing in on those that pose the most risk, your team is able to make the biggest impact on risk with the least amount of effort.

¹Gartner, The Essential Elements of Effective Vulnerability Management, Shilpi Handa, October 5, 2020.

Learn more

• Read the Gartner research report: The Essential Elements of Effective Vulnerability Management.

In the run up to Elon Musk hosting NBC’s Saturday Night Live and the potential mention of Dogecoin on the show, scammers quickly capitalized on his appearance by promoting fake giveaways on Twitter and YouTube.

Background

On May 8, Elon Musk hosted NBC’s Saturday Night Live. Musk, who is a known supporter of the cryptocurrency Dogecoin, teased the possibility that he might talk about the coin on the show, which led to much online speculation.

Scammers, who have used Musk’s likeness to promote fake cryptocurrency giveaways in the past, seized on the feverish support behind Dogecoin, Bitcoin, Ethereum, and other cryptocurrencies, by leveraging compromised and fake Twitter accounts, as well as compromised YouTube channels to successfully peddle phony cryptocurrency giveaways.

Analysis

My analysis began on May 7, so for the purposes of this blog post, I will only be discussing the activity I observed from May 7 through May 9.

• Scammers compromised a number of both verified Twitter accounts and YouTube channels with a significant following and pivoted them into fake SNL accounts in order to drive traffic to fake cryptocurrency giveaway sites.
• I estimate that scammers potentially earned over $10 million dollars across all of their campaigns.
• Compromised YouTube channels were the biggest catalyst for the Dogecoin scams and their relative success.
• Twitter and YouTube need to take more proactive steps to protect verified account holders and large YouTube channels on their platforms.

Verified Twitter accounts compromised and pivoted to impersonate SNL Miley Cyrus

The primary activity I observed involved the compromise of verified Twitter accounts. These accounts run the gamut, from sports-related figures, government representatives, businesses, and other notable individuals.

Once these verified Twitter accounts were compromised, the scammers pivoted them away from their original owners by changing the avatar or profile picture as well as the associated name. They typically pivoted these accounts to impersonate the NBC SNL Twitter account by using the same or similar profile image and name as the legitimate account.

The actual content of the tweets did not include a link; they obfuscated the links by adding slashes around them. I believe this is a tactic to prevent Twitter from using automated systems to block these tweets or flag these accounts.

By compromising verified Twitter accounts, scammers are able to trade on a significant level of trust from most Twitter users who are more likely to trust posts from accounts with blue check marks. However, users may not realize the accounts are fake, because while a name can be changed (e.g. from Troy Stecher to SNL), the usernames for these accounts are often unchanged.

In addition to scammers compromising accounts and impersonating SNL’s Twitter, I also found some accounts impersonating Miley Cyrus, the musical guest appearing on SNL alongside Musk.

One particularly interesting observation I made from the tweets being shared from these verified accounts was the quote: “Our mission is to advance humanity by solving the world’s hardest problems.” It turns out, this was a quote from venture capitalist and engineer, Chamath Palihapitiya. Chamath is another notable figure that scammers have impersonated in order to peddle cryptocurrency scams over the last year. So, it makes me wonder if the same scammers decided to pivot into the SNL impersonation game.

Fake Twitter accounts impersonate SNL and Elon Musk

In addition to the rash of compromised, verified accounts, scammers also created fake Twitter accounts to impersonate SNL and Elon Musk. These accounts aren’t verified, so they don’t have the blue check mark (or verified badge) associated with their accounts. To a certain extent, this may explain why they did not have the same level of success as the compromised verified accounts at stealing cryptocurrency from unsuspecting users.

Similar to the compromised verified accounts, the fake accounts do not include direct links in their tweets.

Despite the limitations of not being verified, the people operating these fake accounts are relentless, posting very consistently in hopes that users will fall for their tricks.

Compromised YouTube accounts used to promote fake live videos

In addition to the activity on Twitter, I also identified multiple compromised YouTube channels impersonating the SNL YouTube channel.

This isn’t the first time cryptocurrency scammers have turned to YouTube to promote their scams. They have used the “YouTube Live” functionality to peddle fake giveaways as part of an ongoing tactic that began in late 2019, but continued throughout 2020. The fake YouTube Live tactic works extremely well in this instance because Musk was hosting Saturday Night Live, and he even shared a link on his Twitter for international viewers to watch SNL on YouTube. I believe this is what helped spur the success of these fraudulent cryptocurrency YouTube Live campaigns.

Special link to view SNL outside USAhttps://t.co/egSDZ8sNFu

— Elon Musk (@elonmusk) May 8, 2021

Plus, the template for these videos is well put together.

When users visit these fake YouTube Live videos, they’re presented with a pre-recorded video of Elon Musk from one of his many interviews or appearances elsewhere. However, the video is placed into a template that positions it near a fake Tweet from Musk claiming to be giving away money, as well as instructions and a URL to a website that users are encouraged to visit in order to participate. Often, the video descriptions will contain a link to the fake giveaway websites, but overall, the scammers opted to incorporate them into the YouTube Live video template itself. Like with Twitter, I suspect this is because the scammers do not want to make it easier for YouTube to automatically detect and remove their access from these compromised accounts.

The compromised YouTube channels are global, as I observed compromised channels from the United States, Brazil, Germany, Indonesia, Philippines, Saudi Arabia, Kazakhstan and India. In particular, one of the largest accounts that was compromised belonged to Wave Music Bhojpuri, which had 18.6 million subscribers.

When a user stumbles across one of these YouTube Live videos with tens of thousands of people watching, along with the clever templating used within the videos themselves, it makes it that much more enticing, and will ultimately lead to success for the scammers.

Giveaway Pages: Teaching an old “Doge” new tricks (much wow)

Example of a classic cryptocurrency giveaway website

The majority of landing pages associated with these fake cryptocurrency giveaways followed the traditional format: a fake Medium blog site with links to individual pages for varying cryptocurrencies from Bitcoin, Ethereum and Dogecoin. Historically, Dogecoin wasn’t one of the popular cryptocurrencies used in these giveaway scams. However, with all of the attention around it in part because of Elon, but also because of the large community of Dogecoin supporters, it was included in many of the landing pages I observed.

The classic cryptocurrency giveaway page now includes a link to “get free DOGE”

In addition to the traditional format, scammers stepped up their game and have begun using a newer template specifically for Dogecoin related giveaway scams.

Example of a Dogecoin cryptocurrency giveaway scam, using a new, well designed template and Doge imagery

The new pages are extremely well designed with a “much wow” factor, using more distinct imagery associated with Dogecoin. I would argue that the design of these pages is just another factor in what helps these campaigns be successful.

Scammers make millions in the Elon Musk SNL campaign

While it is challenging to try to capture every single fake Twitter account and YouTube channel and their associated websites, I was able to track 62 unique cryptocurrency addresses associated with at least 40 domains and determined that the scammers linked to these campaigns made over $10 million dollars over the weekend. This is based on the following dollar value for each cryptocurrency at the end of the day on May 9.

From a cryptocurrency perspective, unsurprisingly, Dogecoin was the coin scammers had the most success stealing.

The scammers managed to steal over $10 million in Dogecoin, which represented just over 90% of the cryptocurrency stolen during these campaigns. The scammers also stole over $595,000 Bitcoin and over $475,000 Ethereum, with the latter seeing a significant increase in price over the weekend, reaching above $4000.

From my analysis, the most successful campaigns were tied to YouTube videos, stealing over $9 million dollars. This was followed by verified Twitter accounts, which stole over $1.3 million, while unverified Twitter accounts were able to steal just over $100,000.

The largest single grossing Dogecoin address used in these campaigns was one associated with a YouTube Live campaign linking to dogecoin-snl[.]com. The address tied to that campaign stole over 3 million Dogecoins.

Based on the market value at the time this blog post was written, one Dogecoin was worth $0.53. At this price, the scammer responsible for this campaign earned $1.6 million USD.

While that was the most successful single campaign, several of the campaigns I identified also found success in rotating either URLs and/or wallet addresses.

For instance, one particular compromised campaign operated by a scammer rotated multiple domains and wallet addresses out to earn $1.5 million dollars in Dogecoin.

The success here was largely driven by a single compromised YouTube channel and all of the viewers they attracted during this campaign. The YouTube Live videos on the channel had a combined view count of nearly 2,000,000 viewers across several live streams.

On Twitter, the most successful campaign involved verified Twitter accounts promoting two domains: snlmusk[.]com and snlelon[.]com. The scammers swapped out addresses for Bitcoin, Ethereum and Doge. In total, they used six Bitcoin addresses, four Ethereum addresses and three Dogecoin addresses. In total, their efforts netted them just under $800,000 after adjusting for transactions made prior to May 7 for one Dogecoin address.

The largest single campaign using a verified Twitter account was for the domain btclive[.]top. It was also circulated among unverified accounts. The scammers behind it were able to steal 1.89 Bitcoins, worth $111,516.59 for their efforts.

It is important to note that Tenable Research did not perform any deep analysis of the transaction history for these cryptocurrency addresses. We only subtracted from the totals for transactions that occurred before May 7 and after May 9. It is certainly possible that the scammers sent Dogecoins and other cryptocurrency to themselves as a way to prop-up the amount received to serve as proof, and entice others into sending cryptocurrency their way.

Cautionary tale for social media apps: cryptocurrency scams will persist

I’ve been monitoring cryptocurrency scams since 2017, which was the year of the last bull market in cryptocurrency. In 2021, cryptocurrency is in the throes of another bull market, as prices for Bitcoin and other cryptocurrencies, including Ethereum and Dogecoin have increased significantly. As long as we remain in a bull market, we should anticipate these types of scams will continue to persist.

How can social media services better address these scams on their platform? Well in 2018, Twitter responded to the increase in compromised verified Twitter accounts impersonating Elon Musk by putting a stop-gap in place when users tried to change their Twitter account name and image to Elon Musk. This was a step in the right direction, but as we’ve seen, scammers are very determined and will search for ways to get around these mechanisms.

I believe that both Twitter and YouTube can take a harder stance to stem the tide of these account compromises by taking more proactive steps to monitor for changes to verified Twitter and YouTube channels with a large number of subscribers, by taking the following steps:

• Flag when an active or dormant verified Twitter account changes its name and avatar and starts tweeting in response to other accounts during a certain period of time
• Flag when a YouTube Channel changes its name and starts doing YouTube Live streams
• Enforce two-factor authentication on verified Twitter accounts and YouTube channels with a large subscriber base

Social media platforms need to place more scrutiny on these types of accounts because, as mentioned before, verified badges, or any form of social proof (like a large YouTube subscriber base) is invaluable not just to notable figures, but to scammers as well. Enforcing more stringent policies for these Twitter accounts and YouTube channels won’t stop the cryptocurrency scams from persisting, but they can help stem the tide, as we should not let perfect be the enemy of good.

Are there any other events we can expect will be the ideal subject for scammers? Certainly. It’s hard to predict what that might be, but in the cryptocurrency space, anything is possible. For instance, will this be the last time we see a Doge-related cryptocurrency scam? Not likely. After his appearance on SNL, Musk announced that his company, SpaceX, will be launching a satellite named DOGE-1 to the Moon that will be paid for entirely in Dogecoin.

SpaceX launching satellite Doge-1 to the moon next year

– Mission paid for in Doge
– 1st crypto in space
– 1st meme in space

To the mooooonnn!!https://t.co/xXfjGZVeUW

— Elon Musk (@elonmusk) May 9, 2021

Whenever SpaceX plans to launch this satellite, you can expect scammers will be ready to capitalize on this event with scams on Twitter and YouTube.

As we were preparing the publication of this blog post, Musk tweeted out a poll question to his followers, asking them whether or not Tesla should accept Dogecoin as a form of payment.

Do you want Tesla to accept Doge?

— Elon Musk (@elonmusk) May 11, 2021

Within the replies of this tweet, was a compromised verified Twitter account impersonating Tesla, attempting to drive users to another fake cryptocurrency giveaway site in the same vein as the SNL accounts seen over the weekend. While it seemed like things had died down after Musk hosted SNL, it’s clear the scammers will continue to capitalize on Musk and Tesla’s tweets about Dogecoin and other cryptocurrencies.

Join Tenable's Security Response Team on the Tenable Community.

Tenable's Security Response Team examines some of the most common Active Directory misconfigurations targeted by attackers and offers proactive measures to help cyber defenders disrupt attack paths. 

Microsoft's Active Directory is one of the most widely used technologies for the administration of groups and users within an organization's IT networks. It serves as the central management interface for Windows domain networks, and is used for authentication and authorization of all users and machines. This makes Active Directory a prominent and valuable target for threat actors, as attackers are able to use it as a foothold to deploy malware, create new user accounts, add new machines to the network and leverage its functionality for lateral movement. 

Once an attacker has gained a foothold into an organization's Active Directory, they can perform a number of malicious actions, such as creating new administrative users, adding new machines to the domain, deploying ransomware across the network, compromising sensitive systems, stealing sensitive data and more. By compromising just a single asset on the domain, an attacker may be able to elevate privileges and move laterally across a network, targeting sensitive data or devices along the way.

Yet, the administration of Active Directory can be complex and challenging for IT teams, and securing it can be equally complicated for security professionals. Many organizations lack security professionals with Active Directory skills and expertise. 

The challenges of securing Active Directory in the enterprise

Threat actors are well aware of common configuration issues and will look to capitalize on them as soon as they gain entry to your organization. Once an attacker gains control of Active Directory, they effectively have the "keys to the kingdom" which they can use to access any device or system connected to the network. In addition, if Active Directory serves as your Identity Provider (IdP), a compromise of it could impact your single sign-on (SSO) solution, giving attackers even more access to additional accounts which a user might be configured with access to.

Configuration issues and common security issues are the two main Active Directory risks in most organizations. Organizational challenges can also arise. For example, in many organizations, IT administrators manage Active Directory deployments, while their security counterparts are the ones responsible for protecting it. Many organizations are faced with limited IT and security budgets and security practitioners in particular are often expected to be knowledgeable in multiple domains. The result? Expert knowledge on Active Directory — and the many intricacies involved with properly implementing it — can be in short supply. 

Our new whitepaper, Securing Active Directory: The Top 5 Configuration Mistakes Putting Your Organization at Risk, aims to give busy security and IT professionals a place to focus their Active Directory efforts. Tenable's Security Response Team (SRT) analyzed breach notices and consulted with our expert research team to provide insights into the Active Directory misconfigurations we believe are most likely to be exploited in an attack. 

The whitepaper explores the reasons why such misconfigurations can happen in an organization, how they help attackers and what organizations can do to address them.  

A closer look at two vulnerabilities affecting Active Directory

Although vulnerabilities directly impacting Active Directory have not been commonplace, attackers tend to chain vulnerabilities together in an attempt to elevate their privileges and often leverage legitimate accounts and Active Directory access to further pivot and access or attack sensitive systems on a network. The paper provides insights into two prominent vulnerabilities — Zerologon (CVE-2020-1472) and ProxyLogon (CVE-2021-26857 and others) — and how they can impact Active Directory.

Download Securing Active Directory: The Top 5 Configuration Mistakes Putting Your Organization at Risk and you'll learn:

• How attackers exploit and leverage Active Directory to attack organizations

• What types of vulnerabilities are used to target Active Directory

• What you can do to better protect your organization from common Active Directory misconfigurations


Improving cyber hygiene, having regular patching cycles, developing plans to address out-of-band patches and performing regular backups can all help to prepare your organization for the next vulnerability that could impact your Active Directory environment. Administrators and defenders must be ready and stay vigilant, implementing policies to reduce their exposure and protect their core.

Learn more

• Download the whitepaper: Securing Active Directory: The Top 5 Configuration Mistakes Putting Your Organization at Risk

• Read the blog: Disrupting the Pervasive Attacks Against Active Directory and Identities

• See more from Tenable Research here


VMware has issued patches for a critical remote code execution vulnerability in vCenter Server. Organizations are strongly encouraged to apply patches as soon as possible.

Background

On May 25, VMware published an advisory (VMSA-2021-0010) regarding two vulnerabilities impacting vCenter Server, a centralized management software for VMware vSphere systems. In a rare move, VMware also published a blog post providing guidance on how users can mitigate these vulnerabilities.

In February, VMware patched two other vCenter Server vulnerabilities, CVE-2021-21972 and CVE-2021-21973. Researchers saw mass scanning for CVE-2021-21972 within a day of its publication.

Analysis

CVE-2021-21985 is a remote code execution vulnerability in the vSphere Client via the Virtual SAN (vSAN) Health Check plugin, which is enabled by default. This vulnerability is assigned a CVSSv3 score of 9.8, making this a critical flaw.

To exploit this vulnerability, an attacker would need to be able to access vCenter Server over port 443. Even if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network. VMware specifically calls out ransomware groups as being adept at leveraging flaws like this post compromise, after having gained access to a network via other means such as spearphishing. Successful exploitation would give an attacker the ability to execute arbitrary commands on the underlying vCenter host.

CVE-2021-21986 is an authentication mechanism issue in several vCenter Server Plug-ins, which is assigned a CVSSv3 score of 6.5, making it moderate severity. The affected vCenter Server Plug-ins include:

• vSAN Health Check
• Site Recovery
• vSphere Lifecycle Manager
• VMware Cloud Director Availability

CVE-2021-21986 can also be exploited via port 443 and allow an attacker to perform plugin functions without authentication.

Both of these vulnerabilities impact vCenter Server versions 6.5, 6.7, and 7.0.

Proof of concept

At the time this blog post was published, no proof-of-concept code was available for either CVE-2021-21985 and CVE-2021-21986.

Solution

VMware has released patches to address both of these vulnerabilities and recommends organizations urgently mitigate them, particularly CVE-2021-21985.

VMware published a FAQ page with additional details about patches and mitigations. If patching is not possible, VMware has published a workaround page with guidance on how to disable the vSAN plugin, along with several others. This is a temporary measure until patches can be applied. For more detailed guidance, please refer to VMware’s blog post.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• VMware Advisory VMSA-2021-0010
• VMware Blog Post
• Tenable Blog for CVE-2021-21972, CVE-2021-21973, CVE-2021-21974

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

The Department of Homeland Security has issued key guidance for oil and gas operations in the wake of recent cyberthreats. Here are three practical ways to disrupt attack paths in your OT infrastructure. 

The oil and gas industry heavily depends on automation for a variety of different operations. The symphony of operations required to find, extract, refine, mix, collaborate and ultimately deliver oil and gas all rely on operational technology (OT) infrastructure.

Recent disruptions in critical infrastructure OT environments, including the Colonial Pipeline incident, have underscored the susceptibility of critical infrastructure to cybersecurity vulnerabilities, threats and potential outages. 

Other attacks against the oil and gas sector include:

• February 2020 - A cyberattack was launched against a natural gas facility concurrently encrypting both the IT and OT networks and locking access to the human-machine interface (HMI), data historians and polling servers. The pipeline was forced to shut down for two days.

• December 2018 - An Italian oil and gas industry contractor fell victim to a cyberattack that hit servers based in the Middle East, India, Scotland and Italy.

• April 2018 - A cyberattack on a shared data 
network forced four U.S. natural-gas pipeline operators to temporarily shut down computer communications with their customers.

• August 2017 -  A Saudi Arabian oil and natural gas facility was shut down by the Xenotime group of hackers.


The DHS- TSA 2021-1 Pipeline Directive

On May 28, 2021, the U.S. Department of Homeland Security (DHS) - Transportation Security Administration (TSA) issued Security Directive 2021-1 specifically for pipeline operations. While other oil and gas industry standards have previously been enacted (see list below), this directive was issued due to an ongoing security threat to U.S. pipeline operations. It represents an important inflection point in securing critical infrastructure environments that might otherwise be at risk.

Security Directive Pipeline 2021-1 gives guidance to pipeline operators in three key areas:

1. Owners and operators of pipeline operations must report security incidents to the Cybersecurity and Infrastructure Security Agency (CISA).

2. A cybersecurity coordinator must be assigned and available 24/7 to coordinate security practices, meet specific requirements outlined in the directive and react when incidents occur.

3. Oil and gas facilities must assess their current cybersecurity practices and activities to address cyber risks against the TSA's 2018 Pipeline Security Guidelines, identify gaps between their current cybersecurity practices and those listed in the guidelines, and develop remediation plans to fill those gaps. 


Key standards relevant to the oil and gas industry

National Institutes of Standards and Technology (NIST) Cybersecurity Framework (CSF): The pre-eminent framework adopted by companies in all industry sectors. Natural gas and oil companies increasingly orient enterprise-wide programs around NIST CSF.


International Electrotechnical Commission (IEC) 62443. Family of standards for industrial control systems (ICS) security. Widely adopted by the production segment of the natural gas and oil industry. Applicable to any type of natural gas and oil ICS.


API Standard 1164: Content unique to pipelines not covered by the NIST CSF and IEC 62443.


Department of Energy Cybersecurity Capability Maturity Model: Voluntary process using industry-accepted best practices to measure the maturity of an organization's cybersecurity capabilities and strengthen operations.


International Organization for Standardization (ISO) 27000: Leading standard providing requirements for an information security management system (ISMS).


Three Key OT Security Best Practices to Reduce Risk

While the DHS-TSA 2021-1 Directive highlights key needs relevant to oil and gas operators, the biggest challenge for most organizations is how to operationalize the three key components of the directive:

• identifying risk; 

• rooting out gaps in security; and

• mitigating incidents when they occur. 


Here are three key OT security best practices we believe should be implemented thoroughly and with urgency to secure pipeline operations and keep them resilient.

1. Gain visibility and deep insight. The oil and gas industry requires synchronized operations across the entire infrastructure as well as access to credentials by a wide, heterogeneous audience. Active Directory (AD) occupies a key role here and, in the case of Colonial Pipeline, the ransomware attack took advantage of this attack vector. Individuals that utilize AD may include authorized employees, partners, agents and subcontractors. Access requirements may extend beyond the actual plant to offsite and remote drilling locations or pipelines across the globe. Consequently, it is essential to maintain access and configuration control that spans from the main facility to all locations, regardless of how remote or distributed they are. The OT security solution must always have the intelligence of individual devices at all locations, including but not limited to programmable logic controllers (PLCs), HMI controllers, engineering stations, networking equipment, gateways and any other devices critical to  regular network operations. Deep knowledge, including visibility into all types of devices, patch levels, firmware versions and backplane information, is essential. It is also critical to account for dormant devices that are not communicating regularly over the network.

2. Identify threats. While the OT operations of oil and gas providers were once isolated, today they are connected to IT and are accessible anywhere. This convergence creates an environment that can impact the integrity of oil exploration, extraction, refining and delivery. The elimination of air gapping enables bad actors to penetrate parts of the operations environment from either the IT or the OT side. To identify a variety of suspicious behaviors it is essential to leverage three detection engines:

   • Traffic mapping and traffic visualization to identify and alert against communication attempts from external sources, in addition to devices that should not be talking to one another.

   • Anomaly detection to pinpoint traffic patterns that are outside of the regular network operation.

   • Signature-based detection to identify known threats which are used by attackers.

3. Close vulnerabilities faster. Most oil and gas environments contain a mix of older devices typically not found in IT environments. With various patch levels across each device type, it is difficult to maintain an up-to-date patch management program. Because oil and gas environments may not have frequent or long enough  maintenance windows, known vulnerabilities may not be patched for an extended time period. It's critical to maintain deep awareness of the state and characteristics of all devices. This includes accurate matching between specific device conditions and the available vulnerability knowledge base that has associated exploits. Because of the dynamic nature of oil and gas environments, this body of knowledge must be kept in sync with newly discovered vulnerabilities. Tenable's Vulnerability Priority Rating (VPR), for example, can provide a triaged list of vulnerabilities from most-  to least-serious, based on a variety of factors such as Common Vulnerability Scoring System (CVSS) score, vulnerability severity and exploitability,  and much more. 


In Summary

OT cybersecurity is now widely recognized as a core ingredient to ensuring a reliable, efficient and safe critical infrastructure that society relies on. You need full visibility, security and control into all of your operational assets. Best-in-class approaches to OT security are more critical than ever both with respect to complying with existing  standards as well as this newly released DHS directive, but also as part of a duty of care to our communities. Constantly changing threat conditions require deep situational awareness in real time, both at the network and devices level. Situational awareness should be updated regularly and kept in sync with newly discovered vulnerabilities, threats and gaps. Any deviation must be captured in real time and documented. Full paper trails, capturing all changes to the environment, are essential. Capturing and maintaining this detailed information can help speed incident response, highlight and prioritize newly discovered vulnerabilities and demonstrate proactive compliance both internally and to the required compliance organizations.

Learn more:

• Read the blog: Colonial Pipeline Ransomware Attack: How to Reduce Risk in OT Environments
• Visit the solutions page: Industrial Cybersecurity to Secure Oil and Gas Operations 

• Download the whitepaper: Critical Infrastructure Cybersecurity 

Prototype pollution vulnerabilities are complex issues which can put your web applications and users at serious risk. Learn how these flaws arise and how Tenable.io Web Application Scanning can help.

JavaScript is a language implemented in nearly all web applications, from building rich client interfaces with frameworks like AngularJS to designing efficient backends using a NodeJS environment. For developers, there is a plethora of libraries available, and they are often used without any prior security assessment. Over the last few years, prototype pollution vulnerabilities have been discovered in many of these libraries, introducing serious security risks to applications utilizing them (see for example the security advisories issued for the Node Packet Manager packages). For example, the popular JavaScript library Lodash, used as a dependency by more than 140k packages, has been impacted by this bug referenced as CVE-2020-8203. From cross-site scripting (XSS) to remote code execution (RCE) attacks, malicious actors can conduct advanced exploitation scenarios with prototype pollution vulnerabilities.

In this post, we will cover the key concepts behind prototype pollution bugs, and how Tenable.io Web Application Scanning (WAS) can help you proactively identify these vulnerabilities.

Prototype Concepts

Prototype-based programming is based on the process of defining objects called prototypes, which are then extended or cloned to create new objects. Once instantiated, these objects will carry over the properties and the functions of their prototype, as well as their local properties or functions.

JavaScript is one of the most commonly used prototype-based languages in modern web applications. Most of the JavaScript objects are derived from the Object class and share the same prototype called Object prototype. For example, a basic JavaScript object can be created with the following snippet of code:

This object is simple and contains only one property using the key “company” and the value “Tenable.” Once this new object is instantiated with its literal notation, it will be linked by default to the Object prototype.

Objects can also be instantiated by using a specific constructor function.

By calling this constructor function with the new keyword, the new object will then be instantiated.

The prototype of this newly instantiated object will be the one of its constructor function which is usually the Object prototype.

The inheritance between the objects and their prototype is called the prototype chain. Each time the code checks for a property of an object, the JavaScript runtime will first verify the properties of the current object and then go up the chain until it reaches the top level, which is usually the Object prototype.

The code below shows an attempt to access a property named “theme”, which is not declared in the object. The property is then set on the Object prototype and becomes available in the object through the prototype chain.

For object instances, the link to their prototype is done through the built-in property __proto__, whereas Constructor functions will be linked to their prototype through another built-in property named prototype.

Prototype pollution vulnerabilities via Object prototype manipulation

Prototype pollution vulnerabilities occur when the code of the application allows the alteration of any prototype properties, usually those of the Object prototype. By inserting or modifying a property of a prototype, all inherited objects based on that prototype would reflect that change, as will all future objects created by the application.

In the previous example, the following object was created:

The following code snippet accesses the Object prototype through its __proto__ property to redefine the basic toString() function, which returns a string representation of an object:

Now, each time the toString() function is called on this object, the console will display the ‘stop pollution’ message:

When creating a new object, the same behavior is observed, as it inherits from the Object prototype:

This short demonstration shows that being able to alter the properties of a prototype has an immediate impact on the code accessing and evaluating it.

Exploitation vectors and risks

JavaScript can be used on both the client and server side of a web application.Prototype pollution vulnerabilities exist in both of these contexts and can lead to a wide range of attacks depending on the application logic and implementation.

Most of the time, the first impact of exploiting this type of vulnerability is the ability to perform a denial of service (DoS) attack either on the web server hosting the application or against a targeted user in a client-side attack. Interfering with the JavaScript environment by adding or modifying a property can cause unexpected behaviors, with some logic not executing as intended.

Attackers often use prototype pollution vulnerabilities as a starting point for conducting further attacks on a targeted application. By leveraging the other components loaded in the same context (called Gadgets), the attacker can initiate more complex attacks in order to gain further privileges or access sensitive information.

Client-side exploitation

The exploitation starts with the injection of a payload into an input that is used to build the client-side logic or rendering of the application. The most common source of input is the URL and its different properties, like location.search :

https://vulnerable.app/?__proto__[pollutedKey]=pollutedValue

These types of parameters are a good example of a key-value data structure, where it is common to see URL parsers assign JavaScript objects properties from this type of string without verifying if the target property is correctly linked to the Object prototype.

The following vulnerable code, simplified for the purpose of this post, declares a function that takes a URL as an argument and returns an Object with the parameters and their values extracted from the query string.

The function is then called on a crafted URL which contains a payload to test for a prototype pollution vulnerability.

The return value is an empty Object, but the vulnerability is confirmed by looking at the Object prototype properties which now contains the “pollutedKey” property with the “pollutedValue” value.

The most obvious outcome of the exploitation of a prototype pollution vulnerability in a client-side context is the ability to perform a XSS attack. By identifying a gadget which will rely on a property of an object that can be polluted and interact with the document object model (DOM) of a page, it is possible to trigger client-side JavaScript code execution.

The current research around client-side exploitation also shows a specific use case leading to the bypass of some HTML sanitization libraries. These libraries maintain an allowlist of tags or attributes to be used in the various user inputs of the application to ensure that no malicious content can be submitted. By polluting specific properties, it is possible to modify the allowlist to enable further injection of payloads that could allow for XSS attacks.

Finally, prototype pollution vulnerabilities can also be used to defeat the protection of some web application firewalls (WAF) which would, under certain circumstances, sanitize specific characters to avoid XSS payloads, but may fail to identify JavaScript object pollution.

Server-side exploitation

Server-side exploitation uses the same concept as client-side, relying on the ability to modify properties of the Object prototype using gadgets present in the application context. Because the JavaScript runtime objects executed on the server could be modified, the impact is often more severe and can leave an application open to critical vulnerabilities:

• Remote Code Execution: The proof-of-concept (PoC) related to CVE-2019-7609 affecting the Elastic Kibana software shows that polluting the Object prototype can be a vector to fully compromise a target application and its system. The exploit demonstrates that an attacker can establish a reverse shell on the Kibana server by being able to pollute environment variables loaded by the application.
• SQL Injection: Depending on the application code and modules available, it is also possible to perform attacks like SQL injection as shown in this PoC. This report shows that the TypeORM package implemented a vulnerable mergeDeep function. When used on an object containing properties controlled by an attacker, the Object prototype could be polluted and used to perform SQL injection attacks by appending additional clauses to the queries.
• Authorization and Authentication Bypass: Some applications, for example, may check the permissions or even the authentication data of their users against the properties of JavaScript objects. If an attacker is able to pollute a property that is used during this verification, they could gain privileged access on the target application or even authenticate without having a valid user account.

Exploiting this type of vulnerability can be complex, and requires a deep analysis of the application logic to be able to determine the impact of prototype pollution.

Use Tenable.io WAS to detect prototype pollution issues

Tenable.io WAS helps identify Prototype Pollution vulnerabilities through multiple features:

• Plugin 112719 is dedicated to the detection of generic client-side prototype pollution issues and helps identify CVE-2021-20083, CVE-2021-20084, CVE-2021-20085, CVE-2021-20086, CVE-2021-20087, CVE-2021-20088, CVE-2021-20089 vulnerabilities.

• Three fingerprinters are available to detect NodeJS applications and their two most common web frameworks: ExpressJS and SailsJS. These checks identify applications which are more likely to be impacted by this class of vulnerability.

Prevent and mitigate

There are multiple best practices available to protect applications and users and prevent prototype pollution vulnerabilities:

• Sanitize inputs: One of the most common attack vectors is the assignment of a JavaScript object property from a key-value data structure. Code that performs unsafe operations like merging, cloning or extending objects will often not check for the special properties __proto__ and constructor, allowing for the modification of the prototype. JSON or YAML inputs are commonly used for key-value data and are often used as a source for this type of processing. Properly designed code should perform a strong parsing and validation against the properties that are set to prevent any modification of the Object prototype. For example, the fix released for the popular qs package shows how a weak input validation can introduce a prototype pollution vulnerability.
• Freeze the Object prototype: Server-side contexts can be protected by freezing the Object prototype to make it immutable by using Object.freeze(Object.prototype). Further modification attempts on the Object prototype will silently fail, keeping it safe from any pollution. Although this is a strong mitigation option, this may introduce functional bugs in the application and should be carefully implemented.
• Create prototype-less objects: The JavaScript API allows the creation of prototype-less objects, removing the relationship inheritance used in most cases to perform the pollution. This requires explicitly creating the object with the Object.create(null) function.
• Use Map objects: JavaScript objects are often used to store simple properties as a key-value pair and do not require the presence or the usage of inherited properties and methods. The purpose of the Map object is to offer a safe option to store these key-value pairs without exposing the Object prototype to pollution.

Performing continuous assessment of web applications and mastering the patch management process remain crucial to prevent these types of attacks from succeeding.

Get more information

• Tenable.io Web App Scanning
• Mozilla Developer Network - Object prototypes
• Prototype pollution attack in NodeJS application

Microsoft addresses 49 CVEs with six having been observed as exploited in the wild

1. 5Critical
2. 44Important
3. 0Moderate
4. 0Low

Microsoft patched 49 CVEs in its June 2021 Patch Tuesday release, including five CVEs rated as critical and 44 rated as important.

Tenable's Security Response Team is aware that others may be counting CVE-2021-33741 as part of Patch Tuesday. However, it was patched on June 4 and is not included in our counts.

This month’s update includes fixes for:

• .NET Core & Visual Studio
• 3D Viewer
• Microsoft DWM Core Library
• Microsoft Intune
• Microsoft Office
• Microsoft Office Excel
• Microsoft Office Outlook
• Microsoft Office SharePoint
• Microsoft Scripting Engine
• Microsoft Windows Codecs Library
• Paint 3D
• Role: Hyper-V
• Visual Studio Code - Kubernetes Tools
• Windows Bind Filter Driver
• Windows Common Log File System Driver
• Windows Cryptographic Services
• Windows DCOM Server
• Windows Defender
• Windows Drivers
• Windows Event Logging Service
• Windows Filter Manager
• Windows HTML Platform
• Windows Installer
• Windows Kerberos
• Windows Kernel
• Windows Kernel-Mode Drivers
• Windows Network File System
• Windows NTFS, Windows NTLM
• Windows Print Spooler Components
• Windows Remote Desktop
• Windows TCP/IP

Remote code execution (RCE) vulnerabilities accounted for 34.7% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) at 26.5%.

Important

CVE-2021-31955 | Windows Kernel Information Disclosure Vulnerability

CVE-2021-31955 is an information disclosure vulnerability in the Windows Kernel (ntoskrnl.exe). It was discovered by researchers at Kaspersky and is associated with a “wave of highly targeted attacks” by a group they call PuzzleMaker. An attacker could use this vulnerability to disclose information from the system, such as kernel addresses. They could then combine this with CVE-2021-31956 to elevate privileges on the targeted system.

Important

CVE-2021-31956 | Windows NTFS Elevation of Privilege Vulnerability

CVE-2021-31956 is an EoP vulnerability within Windows NTFS (New Technology File System) which could allow a local user to elevate their privileges on an affected system. A local user could exploit the flaw with a crafted application in order to take control of a system. This vulnerability affects all currently supported Windows variants including Windows Server and Windows Server Core Installations. Microsoft notes that this flaw has been actively exploited in the wild as a zero-day. Like CVE-2021-31955, this vulnerability is credited to researchers at Kaspersky, who have linked this vulnerability to an attack chain from the PuzzleMaker Group, which includes the use of an unidentified Google Chrome zero-day vulnerability.

Critical

CVE-2021-33742 | Windows MSHTML Platform Remote Code Execution Vulnerability

CVE-2021-33742 is a RCE vulnerability in the Windows MSHTML Platform, Microsoft’s proprietary browser engine. The vulnerability received a CVSSv3 score of 7.5 and has been exploited in the wild as a zero-day. CVE-2021-33742 requires user interaction to exploit, so an attacker would need to entice a victim to open a crafted file or visit a malicious website using an affected application.This vulnerability affects all currently supported versions of Microsoft Windows. Microsoft also noted in their release that while the MSHTML Platform was designed for Internet Explorer, which has been retired, the underlying platforms including MSHTML are supported. Discovery of the vulnerability is credited to Clément Lecigne of Google’s Threat Analysis Group (TAG). Shane Huntley, director of the Google TAG says that, while they plan to share more details about the attack in the future, they have linked it to a “commercial exploit company” that has provided “capability for limited nation state Eastern Europe / Middle East targeting.”

More details will be on CVE-2021-33742 will come from the team, but for context this seem to be a commercial exploit company providing capability for limited nation state Eastern Europe / Middle East targeting.

— Shane Huntley (@ShaneHuntley) June 8, 2021

Important

CVE-2021-31939 | Microsoft Excel Remote Code Execution Vulnerability

CVE-2021-31939 is a use-after-free (UAF) vulnerability in Microsoft Excel that could lead to RCE if an attacker is able to convince a target into opening a crafted file. Researchers Sagi Tzadik and Netanel Ben-Simon of Check Point Research wrote a blog post describing their research and fuzzing of Microsoft Office, targeting the MSGraph COM component (MSGraph.Chart.8, GRAPH.EXE). This led to the discovery of CVE-2021-31939 along with three additional CVE’s patched in the May 2021 Patch Tuesday update; CVE-2021-31179, CVE-2021-31174, and CVE-2021-31178.

CVE-2021-31939 is also credited to Zhangjie and willJ from cdsrc, Anonymous working with Trend Micro Zero Day Initiative, Jinquan(@jq0904) of DBAPPSecurity Lieying Lab and Ryelv of Tencent. CVE-2021-31939 received a 5.5 CVSSv3 score and is labeled as “Exploitation Less Likely” by Microsoft with no currently known proof-of-concept code available.

Important

CVE-2021-33739 | Microsoft Desktop Window Manager Core Library Elevation of Privilege Vulnerability

CVE-2021-33739 is an EoP vulnerability in the Microsoft Desktop Window Manager (DWM) core library, dwmcore.dll. It was discovered and reported to Microsoft by researchers at DBAPPSecurity Threat Intelligence Center. In February, DBAPPSecurity Threat Intelligence Center disclosed another zero-day vulnerability, CVE-2021-1732, an elevation of privilege vulnerability in Win32k linked to a threat actor known as BITTER APT. In April, researchers at Kaspersky disclosed CVE-2021-28310, an elevation of privilege zero-day vulnerability in Microsoft DWM Core Library that they connected to multiple threat actors including BITTER APT. While it has not yet been confirmed, it is possible this is another zero-day leveraged by BITTER APT in the wild.

Important

CVE-2021-31983, CVE-2021-31946, CVE-2021-31945 | Multiple Vulnerabilities in Paint 3D

CVE-2021-31983, CVE-2021-31946 and CVE-2021-31945 are RCE vulnerabilities in Microsoft’s Paint 3D, which replaced the original MS Paint. All three received a CVSSv3 score of 7.8 and a severity of Important with an “Exploitation Less Likely” designation. These vulnerabilities are more interesting than concerning. They all require user interaction and the application will automatically update in most cases. However, all three vulnerabilities were discovered by several different researchers including Mat Powell from Trend Micro Zero Day Initiative, Li Qiao of Baidu Security Lab, and garmin working with Trend Micro Zero Day Initiative. One can only speculate why these researchers were examining Paint all at once, unless more information becomes available. Paint 3D wasn’t able to provide any insights either.

Beats us.

— Paint 3D Edu. (@Paint3Dedu) June 8, 2021

Tenable solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains June 2021.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s June 2021 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

• Microsoft's June 2021 Security Updates
• Tenable plugins for Microsoft June 2021 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Ransomware attacks every type of organization from every angle and Active Directory remains the common target. Stop privilege escalation by fixing these key AD and group policy misconfigurations.

Ransomware has struck every type of organization around the world. It's changed dramatically, too, entering the enterprise from nearly every angle, with attackers leveraging stolen data by posting it on the internet to force victims to pay. In most cases (see SolarWinds and XingLocker), Active Directory (AD) is targeted so the attacker can easily distribute the ransomware after obtaining domain privileges. There are, however, ways to help secure Active Directory to prevent ransomware from succeeding.

Distinct areas within Active Directory can be secured, which will increase the overall security of the enterprise and reduce the security risk at the same time. Specifically, the following settings around AD objects can be secured. Here's how:

• Misconfigurations of user attributes need to be fixed

• Misconfigurations of groups need to be fixed

• Privileged groups need to be cleaned up

• AD processes need to have correct configurations (e.g. SDProp)

• Service principal names (SPNs) need to be secured (shown in Figure 1)

• Trust relationships need to be correct and secured

• SidHistory attribute needs to be cleaned up for users


Figure 1. User account with Service Principal Name (SPN)

In addition, AD itself and group policy can be secured to ensure the attacker can't leverage misconfigurations and areas where privilege escalation can be achieved. Here's how:

• AD trusts need to be verified and secured (shown in Figure 2)

• AD delegations need to be cleaned up

• Group policy delegations need to be cleaned up

• Group policy structural components need to be secured

• Security settings deployed by group policy objects need to be enabled


Figure 2. Mergers and acquisitions can orphan trusts; in addition, required trusts need to be secured.

Finally, attackers want to gain privileges. Once privileges are obtained, they want to create backdoors. Being able to detect these types of AD attacks is essential. Below are some of the actions AD admins and security pros can take to disrupt attack paths:

• Ensure privileged group membership is monitored

• Detect DCShadow and DCSync attacks

• Golden Ticket attacks (illustrated in Figure 3)

• Detect lateral movement attacks

• Detect dangerous SIDHistory and PrimaryGroupID settings


Figure 3. Tenable.ad can detect advanced attacks on Active Directory, in real time, with no agent or privilege.

Technology is available to continuously and automatically analyze and detect AD security and attack paths. To find out more about how Tenable.ad can help, view this webinar: Introducing Tenable.ad — Secure Active Directory and Disrupt Attack Paths

Learn More 

• View the webinar: Introducing Tenable.ad — Secure Active Directory and Disrupt Attack Paths

• Download the E-book: A King's Ransom: How to Stop Ransomware Spreading via AD

• Read the Active Directory blog posts


A flaw in Microsoft Power Apps could allow attackers to steal emails, Teams messages and OneDrive files.

Background

Microsoft recently patched a vulnerability in Microsoft Teams, a business communication platform that has surged in popularity with the shift to a remote workforce, recording 145 million daily active users in April 2021. The vulnerability, which was discovered by Tenable Zero-day Researcher Evan Grant, could allow an attacker to take control of an end-user’s account. This could grant the attacker access to the victim’s chat history, the ability to read and send emails on the victim’s behalf, and access files in their OneDrive storage.

Analysis

Microsoft Teams has a default feature that allows users to launch applications as a tab within any team they belong to. Organizations using Office 365 or Microsoft Teams with a Business Basic license or higher can also launch Microsoft Power Apps within these tabs.

Tenable discovered that content loaded into these Power Apps tabs was governed by an improperly anchored regular expression. That is, the validation mechanism used to confirm that the content in the tab comes from a trusted source only verifies that a given URL begins with “https://make.powerapps.com” and does not validate any further. This means an attacker can simply create a subdomain of “make.powerapps.com” for any domain they control, such as https://make.powerapps.com.fakecorp.ca, which allows them to load untrusted content into a Power Apps tab.

The severity of this vulnerability is amplified by the permissions granted to Microsoft Power Apps within Microsoft Teams. Successful exploitation of this flaw allows attackers to take control of any users that access the malicious tab. This includes reading the victim users’ group messages within Teams, accessing the users’ email and OneDrive storage, and more.

Proof of concept

As this flaw is a server side vulnerability, Microsoft fixed the issue without any user action required. Because the issue has been patched, a proof-of-concept will not be released, however detailed information and a full analysis for this issue can be found on the Tenable Techblog. The following video demonstration shows how the flaw could have been abused:

Vendor response

Through our vulnerability disclosure policy, Tenable worked with Microsoft to review and address our findings. For details on the disclosure timeline, please refer to our corresponding Tenable Research Advisory.

Solution

Microsoft implemented a solution to address this issue — no action is required from end-users or organizations.

Get more information

• Tenable Techblog Writeup
• Tenable Research Advisory TRA-2021-23
• Tenable Research Advisories

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

To eliminate network blind spots and fully understand your entire attack surface, it's essential to determine which discovery and assessment tools are required for each asset type.

If you've been in security for more than a few years, you've undoubtedly watched your network evolve from containing strictly traditional, on-premises IT assets to one that comprises both on-prem and cloud-based environments with myriad asset types, including virtual platforms, cloud services, containers, web apps, operational technology (OT) and internet of things (IoT). While the evolution itself is well understood by security professionals, many still struggle to make the appropriate modifications that will enable them to fully discover and properly assess their broad array of modern digital assets.

Back when networks were no more than homogeneous collections of physical, on-premises IT assets, mostly sitting within the organization's well-controlled data center and IP address space, simply running a network vulnerability scanner was sufficient to understand what you had and where you were exposed. It was common to take on a "boil the ocean" approach when evaluating where you were potentially at risk from adversaries exploiting your vulnerabilities. But with today's array of asset types, you need more purpose-built tools to safely and accurately gain visibility across the entire attack surface and develop a deep understanding of the security posture of every asset, wherever it lives in the environment.

Most modern asset types require a specific methodology and/or toolset for discovering and accurately assessing them. Here are a few examples:

• Cloud connectors: Since cloud environments aren't physically attached to the network, a connector is necessary to keep them in contact with the vulnerability management platform.

• Agents: Assets such as laptop computers are oftentimes disconnected from the network during routine scans, causing their vulnerabilities to be missed for long periods of time. Installing agents locally on the host can solve this challenge by continuously monitoring and reporting back findings whenever the asset is attached to the network.

• Active query sensors for OT devices: Most assets in OT and IoT environments are purpose-built systems that operate very differently from traditional IT assets. Because of this, they are best assessed with sensors that can safely query (NOT scan!) these devices using their native command language to determine if vulnerabilities or misconfigurations exist. This allows for constant monitoring not only for potential attacks, but also for misconfigurations in settings and thresholds.

• Web app scanner: Web apps look and behave differently than traditional IT assets for a variety of reasons. And their vulnerabilities are typically categorized as Common Weakness Enumerations (CWEs) rather than Common Vulnerabilities and Exposures (CVEs). As a result, a purpose-built scanner is required to discover and assess web apps to gain an understanding of your web application security posture.

• Container security: Modern digital assets, such as container images, can't be assessed using traditional methods. Security devices made specifically for containers can store and scan container images as the images are built and provide vulnerability and malware detection, along with continuous monitoring and validation of container images.


Of course, a major problem security professionals face today is that they have far more vulnerabilities than they can ever handle. Taking a "boil the ocean" approach simply isn't feasible for most organizations due to resource and time limitations. Instead, you need to determine which vulnerabilities actually pose the greatest risk to your most critical systems, so that you can effectively prioritize your remediation efforts.

To perform effective vulnerability prioritization, you need to analyze your security data to fully understand each vulnerability in context. Problem is, you probably already have too much data to analyze, and you're probably analyzing it all manually. And each of the security tools highlighted above generates even more data, thereby exacerbating the issue. That's why you need a comprehensive vulnerability management platform capable of ingesting all types of security data and employing automation to process and analyze it immediately. This way, you get the security intelligence you need at the speed you require.

In short, matching the right discovery and assessment tools with each asset type enables you to fully understand your entire attack surface by eliminating blind spots across your network. And using a vulnerability management tool capable of ingesting the inputs from each of these tools enables you to assess your various assets in a unified view so you can properly prioritize your vulnerability remediation efforts.

Learn more

• Want to learn more about determining the right sensors and methods for discovering and assessing your entire attack surface ― and then how to effectively deal with the barrage of data that comes with all of that additional visibility? View the webinar, It May Be Time to Stop Freaking Out About Too Many Vulnerabilities
• Learn how to migrate from legacy VM to risk-based VM, including the recommended tools, products and partner integrations for each procedural step. Read the whitepaper, Reference Architecture: Risk-based Vulnerability Management
• Learn why a unified VM platform is necessary to dynamically assess and defend your entire attack surface. Read the whitepaper, Overcoming Challenges Created by Disparate Vulnerability Management Tools

Follow these best practices to harden your Active Directory security against cyberattacks and stop attack paths.

Active Directory (AD) equips businesses using Windows devices to organize IT management at the enterprise level. This centralized, standard Windows system equips IT administrators with increased control over access and security within their operations, elevating management of all network devices, domains and account users. AD delivers several mission-critical manageability, security and interoperability functions for businesses of every size and scope, including: 

• Organizing and consolidating data 

• Supporting communication between domains 

• Generating and implementing certificates

Most importantly, Active Directory grants systems administrators increased visibility of and control over passwords, permissions and access authority within their network. AD allows IT leaders to fine-tune their governance capabilities to better oversee and manage system groups. Additionally, the system streamlines internal processes, helping users access the resources they need quickly and efficiently. 

Active Directory (in)security plays a vital role in cyberattacks 

Failing to prioritize a proactive, dynamic AD security strategy can have significant consequences. Active Directory centralizes user access and authorization across every level of an organization, making it a prime target for cybersecurity hackers. Once inside the system, cyberattackers can often escalate privileges, gaining access to multiple network resources. A single AD security breach can compromise a company’s entire digital infrastructure, enabling hackers to steal private system information from all user accounts, databases and applications in the system. 

8 Active Directory best practices to protect your systems 

Establishing and maintaining Active Directory best practices can help companies counter phishing, malware and other cyberattacks as well as protect users, resources and network. Here is a list of AD best practices to implement now to fortify cybersecurity throughout your systems. 

• Take inventory. To put it simply: You can’t protect what you don't know you have. The most effective way to maintain the highest AD cybersecurity standards is to take a careful, thorough inventory of your entire system. Some essential to-dos should include identifying all of the computers, devices, users, domains and name conventions for your organizational units (OU). 

• Evaluate current security settings. Active Directory offers standardized security settings after installation. These default settings may be the right ones for your organization — or they may not provide the protection your system needs. After installation, always review the existing security configuration to customize the settings based on your specific business requirements. 

• Establish "least privilege" models. "Least privilege" strategies limit users' access to resources in the system based on what is essential to perform the intended role or function. The least privilege model helps minimize overall exposure and the risk of data theft in the event of system compromise. Systematically review all current permissions to determine any necessary least privilege modifications needed. You will also want to create a separation of privileges to ensure there's an added layer of security around various users, tasks and accounts. 

• Limit AD administrator privileges. It's not enough to restrict individual user privileges; it's also critical to evaluate overall IT staff and AD administrator access as well. Only offer administrative and superuser privileges to those in your organization who require this level of access to properly perform their jobs. 

• Develop a security approach for domain controller. A compromised domain controller can undermine the integrity of the entire AD system. If a hacker gains access to a domain controller, they can instantly connect to everything within the infrastructure. The first step is to physically separate domain controllers from other servers. Many businesses use a locked room that has no access from unauthorized users. This added security layer can help prevent an outside intrusion on your domain controllers for increased peace of mind. 

• Use multi-factor authentication. Remote users can be easily compromised, often without even realizing it. Multi-factor authentication (MFA) offers one of the best ways to secure remote devices against an online attack. An MFA solution requires a user to successfully present two or more pieces of evidence before being granted access to the system. Should hackers obtain a user’s Active Directory credentials, the MFA process would prevent them from escalating privileges within the system. 

• Develop monitoring and auditing standards. Consistent, real-time Active Directory monitoring can prove an invaluable resource for businesses committed to protecting their networks. Develop a process that allows authorized personnel to monitor and audit the entire system for any unauthorized or unsafe activity that could put the network at risk. Implementing a solution that evaluates user changes and network behavior can help detect unusual system engagement as quickly as possible to circumvent a potential cyberattack.  

• Educate your team. Employees can pose a significant security risk to companies using AD. Even the most well-intentioned staff member can inadvertently click a phishing link or get scammed by an email designed to trick them into giving away private company information. Training and educating your workforce on the genuine threats and dangers of a cybersecurity attack will equip them with the tools they need to avoid a system compromise. Some basic strategies for both your onsite and remote users include: 

  • Training them to recognize phishing scams and malware attacks 

  • Educating them to understand risk level with various user behaviors 

  • Ensuring no one user has full access to the entire system 

  • Establishing and enforcing a strategic password policy 


Implement a customized Active Directory cybersecurity solution in your business 

Many IT administrators lack the resources and technology needed to implement a cohesive Active Directory security solution in their organizations. Tenable, a leading provider of cybersecurity services, can help. Tenable partners with enterprise businesses across multiple verticals and on a global scale to develop Active Directory solutions that deliver real-time network visibility to detect and prevent cyberattacks. Contact us to schedule your free demo today. 

Learn more:

• How to Protect Active Directory Against Ransomware Attacks

• The Top 5 Active Directory Misconfigurations Putting Your Organization At Risk

• Disrupting the Pervasive Attacks Against Active Directory and Identities


When only select ports require scanning, use these easy steps to define them

When assessing targets with a network scanner like Nessus, a common question is "How do I control the ports that Nessus tests during a scan?" This blog covers a number of options, including:

• How to limit the port scan

• Choosing host enumeration

• Considering unscanned ports closed

• Addressing UDP ports

• Explicit port control

• Alternative options to port scanning


Below, we talk about some of the reasons Nessus sends packets to various ports and how scans can be configured to limit access to specific ports or ranges of ports. This is applicable to any Tenable toolset that uses Nessus in a customizable fashion, like Nessus Professional, Tenable.sc or Tenable.io.

Limiting the port scan

The first setting someone should review, in an effort to minimize the ports touched by a Nessus scan, is the port scan range. Most Nessus scan policies have the port scan range set to "default." When set using the keyword 'default,' the scanner will scan approximately 4,600 common ports. The current list of ports can be found in the nessus-services file on the Nessus scanner at the locations below. 

Windows

C:\ProgramData\Tenable\Nessus\nessus\nessus-services

Mac

/Library/Nessus/run/var/nessus/nessus-services

Linux

/opt/nessus/var/nessus/nessus-services 

Users can enter more specific ranges and ports into the scan policy, such as "21-80", "21,22,25,80" or "21-143,1000-2000,60000-60005". Doing so will cause the port scanner to target just those ports during the port scan. 

If required, 'all’ instructs the scanner to scan all 65,536 ports, including port 0. Note that this can greatly increase the scan time of each target and is not a recommended configuration if scanning through network firewalls.

Choosing host enumeration

If an ICMP probe (a ping), or ARP is enabled to discover active hosts, then no specific ports are probed. However, if a "TCP Ping" is used to discover a host, then a small number of ports will be probed (the default setting in most scan policies). Both options can be enabled and are not exclusive. 

Nessus will also only run subsequent host discovery methods on a target if the previous ones fail or if they’re not enabled.

Considering un-scanned ports closed

After a host is discovered and the desired ports are scanned, Nessus will attempt to run the enabled plugins against the target. If a plugin runs which attempts to connect to a specific port and the "Consider Unscanned Ports Closed" setting is enabled, Nessus won't even run the plugin. However, if this setting is disabled (the default setting in most scan policies), Nessus may start to probe ports that were not specified by the port scan.

Understanding UDP port probes

For port scanning, the UDP protocol is very unreliable. However, Nessus supports it for those customers with specific compliance requirements or unique local environments.

UDP is unreliable because if a port is open, the host is NOT supposed to send a response and if a port is closed, the host is supposed to return an "ICMP Port Unreachable" packet. Since UDP packets can be dropped or a host or network firewall can stop a packet, a scanner that does not get a response for a UDP probe can be fooled into thinking the port is open. Even for closed ports, if a network has implemented outbound ICMP filtering as a security measure, the scanner won't see the "ICMP Port Unreachable" messages.

If the UDP port scanner is enabled, you can specify a split range specific to each protocol. For example, if you want to scan a different range of ports for TCP and UDP in the same policy, you would type:

T:1-1024,U:300-500

You can also specify a set of ports to scan for both protocols, as well as individual ranges for each separate protocol. For example: 

1-1024,T:1024-65535,U:1025

You can also include default in a list of custom ports. For example: 

T:64999,default,U:55550-55555

Note that the default services list in Nessus (discussed above) includes individual definitions for both TCP and UDP ports.

Explicit control for troubleshooting

Given the complex nature of all the various options with port scanning, it can be time consuming to troubleshoot exactly why a scanner is probing a target on a certain port. Nessus offers an engine level control that allows prevention of communication with a specific port (or range) by using nessusd.rules. 

Alternatives to network port scanning

Credentialed assessments

When Nessus can login to the target, it will attempt to run the equivalent of 'netstat’ locally (or use SNMP on network devices) and enumerate ports first before running network port scanners (the default setting in most scan policies). This is much more efficient, as Nessus knows exactly what ports are open without having to test them all individually.

Passive insight

Tenable.sc and Tenable.io customers who have deployed a Nessus Network Monitor (NNM) enjoy continuous monitoring of their network as well as some advantages over active scans. Since the NNM operates 24x7 and watches all traffic, it can see activity on the network that might not be present during an active scan, ports that are not specified in a scan policy or otherwise blocked from the scanner.

Agents

For Tenable.sc or Tenable.io customers, deploying Nessus agents can also be an option to limit the port probing in a traditional Nessus network assessment. By design, Nessus agents don’t perform any network-based testing. They will enumerate local ports, like a credentialed scan does, but they don’t reach out and test ports for vulnerabilities or scan ranges of ports to see what is listening.

Additional Documentation

• Tenable Community: List of ports in Nessus defined by Port Scan Range 'default’

• Tenable Community: What ports does 'built-in’ represent?

• Tenable Community: Ping Type Order/Hierarchy 

• Tenable Community: What is the nessusd.rules file?

• Tenable Community: Phases of a vulnerability scan

• Tenable Community: Why is Nessus Scanning Ports Outside of the Port Range?

• Tenable Community: Tenable Scan Strategy Guide

• Tenable Blog: 4 Ways to Improve Nessus Scans Through Firewalls

• Documentation: Nessus Scan Policy Discovery Settings


Learn more

• Watch the video to see why American Eagle Outfitters uses Nessus, https://youtu.be/aZgAjBnPTAc

• View our online demo: https://www.tenable.com/nessus-demo

• Visit our Nessus product page, https://www.tenable.com/products/nessus

SonicWall issues a new advisory and CVE identifier to address an incomplete fix for CVE-2020-5135.

Background

On June 22, SonicWall published an advisory (SNWLID-2021-0006) to address an incomplete fix for a vulnerability in its operating system, SonicOS, used in a variety of SonicWall network security devices, including its SSL VPNs. This advisory contains a newly assigned CVE identifier; the original vulnerability was CVE-2020-5135.

Discovery of the vulnerability is credited to Craig Young of Tripwire’s Vulnerability and Exposure Research Team (VERT). According to Young, this advisory addresses an “unsuccessful” fix for CVE-2020-5135, a critical vulnerability that was patched in October 2020. Young was one of the researchers credited with the original discovery of CVE-2020-5135.

Analysis

CVE-2021-20019 is a buffer overflow vulnerability in SonicWall’s SonicOS. A remote, unauthenticated attacker could exploit the flaw by sending a specially crafted HTTP request to a vulnerable SonicWall device. Successful exploitation of this vulnerability would result in a partial memory leak, disclosing sensitive internal information to the attacker. In a blog post, Young says that the information disclosed could include memory addresses that would be “useful information” for “exploiting an RCE bug.” For more technical details, please refer to Young’s blog post.

Over 680,000 SonicWall devices remain publicly accessible

In our previous blog post about CVE-2020-5135, we highlighted that there were nearly 800,000 SonicWall devices publicly accessible based on results from two separate Shodan queries.

• product:"SonicWALL firewall http config"
• product:"SonicWALL SSL-VPN http proxy"

Reviewing those same queries today, we see that there are still over 680,000 SonicWall devices that remain publicly accessible, more than seven months after the initial disclosure of CVE-2020-5135.

As a word of caution, Tenable’s Security Response Team cannot independently confirm that all of the hosts publicly accessible via these Shodan search results are impacted by CVE-2021-20019. The intention behind highlighting the number of publicly accessible hosts is to provide context for the potential attack surface for threat actors.

A reminder that remote access vulnerabilities are a valuable tool in attacker playbooks

As we highlighted in our 2020 Threat Landscape Retrospective report, three of the top five vulnerabilities from last year were SSL VPN flaws. In 2021, we’ve seen remote access product flaws remain a valuable tool in attacker playbooks, including CVE-2021-20016, a zero-day vulnerability in SonicWall’s Secure Mobile Access (SMA) devices that was exploited in the wild earlier this year.

If your organization uses SonicWall devices, including their SSL VPN, we strongly recommend you apply these patches as soon as possible.

Proof of concept

At the time this blog post was published, there were no publicly available proof-of-concept (PoC) exploits for CVE-2021-20019, aside from Young’s own private PoC.

Solution

SonicWall has patched CVE-2021-20019 across several versions of SonicOS, though at the time this blog post was published, two versions did not have a fix available yet. We will update the table below once those fixes become available.

* In its advisory, SonicWall lists SonicOS 6.5.4.7-83 and below as affected, but in the table of Fixed Software, they list 6.5.4.8-83 and below as affected, creating a discrepancy.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• Analyzing SonicWall’s Unsuccessful Fix for CVE-2020-5135
• Tenable Blog Post for CVE-2020-5135
• SonicWall Advisory for CVE-2021-20019 (SNWLID-2021-0006)

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Scammers are on pace to steal nearly $1 million USD from unsuspecting users through a popular decentralized finance protocol, Uniswap, by abusing YouTube to promote a fake SpaceX coin as part of ads appearing before and during cryptocurrency videos.

Background

In early May, scammers compromised Twitter and YouTube accounts to promote a series of cryptocurrency scams ahead of Tesla and SpaceX founder Elon Musk’s appearance on Saturday Night Live, stealing over $10 million dollars in Bitcoin, Ethereum and Doge tokens. The scams conducted via YouTube were the most successful, resulting in a theft of over $9 million dollars.

Please note that both “tokens” and “coins” are used interchangeably to describe cryptocurrency like Bitcoin, Ethereum, Dogecoin, and many others.

Since the end of May, scammers have stolen over $430,000 in cryptocurrency from unsuspecting users by purchasing advertising space on YouTube cryptocurrency videos to promote a fake SpaceX coin (or $SpaceX token) claiming to be created by Musk. At the time this blog post was published, the scammers had one ongoing campaign that, once complete, would potentially increase the total amount of stolen cryptocurrency to nearly $1 million.

Analysis

As early as May 22, YouTube advertisements designed to scam users out of their cryptocurrency appeared before or during videos about cryptocurrency from popular creators in the space. The advertisements featured a variety of unrelated videos of Musk, who’s garnered much attention for his support of cryptocurrencies like Bitcoin and Dogecoin in recent months.

Breaking down the template

The advertisements are three to five minutes long and feature a template that includes a falsified tweet at the top from Elon Musk that claims he’s launching his own cryptocurrency called $SpaceX.

Within the same template is a description section, featuring a header with the Tesla logo. The description says “Elon Musk is launching his own cryptocurrency, $SpaceX.” The purpose of the coin, the scam advertisement claims, is to “take everyone to mars and make human life possible there.” Finally, they add that for each transaction involving the $SpaceX coin, a donation will be made “towards space research companies” in order to “help Elon’s mission.”

The embedded video in the advertisement above is a clip from Elon’s interview for the Computer History Museum and KQED’s “Revolutionaries” from 2013. The scammers use various videos of Musk indiscriminately in these YouTube ads.

Videos hosted on compromised YouTube accounts

These advertisements are hosted on compromised YouTube accounts.

When they appear, the name of the user associated with the advertisement is visible.

When browsing the user’s profile, we see that this user joined YouTube in August, 2011. Many of the accounts I encountered were created between 10-12 years ago. In this instance, there are no other videos associated with the account, except for the one used in the scam advertisement, but that may vary. It is likely these are dormant YouTube accounts, which scammers were able to compromise to promote their dodgy advertisements.

We reached out to YouTube to share our findings prior to publication, but we did not receive a response.

Same template used in previous YouTube Live scam campaign

These advertisements leverage the same template I saw being used in the SNL-themed Musk scams from earlier in May, including the Tesla logo.

In the YouTube ads regarding the supposed SpaceX coin announcement, you would think the scammers might have swapped in the SpaceX logo instead of keeping the Tesla logo, but it appears they just copied the template outright.

Users directed to multiple websites

The YouTube ads themselves do not contain a direct link to a website. Instead, they advertise the website in another section of the template. During my analysis, I found at least twelve different websites being promoted through these fake YouTube advertisements, which include:

Please note this may not be an exhaustive list of all domains used in these campaigns.

Websites include step-by-step directions on installing MetaMask and using Uniswap

The websites used in this campaign were designed using Telegram’s anonymous blogging platform, Telegra.ph.

To get users to purchase the fraudulent $SpaceX coins, the scammers include a step-by-step walkthrough on how to install MetaMask, a popular browser-based wallet used by millions of users, on their computers. I verified that the scammers are linking to the legitimate MetaMask extension for Google Chrome instead of a fake extension.

From there, the website instructs users to click on a customized link to Uniswap, a popular decentralized exchange (DEX) in the world of decentralized finance (DeFi) protocols. As a DeFi protocol, Uniswap allows cryptocurrency holders to exchange (or swap) tokens on the platform without a centralized entity being involved, hence the decentralized nature. At the same time, the lack of a central authority is one of the reasons why these scams are able to operate successfully.

Uniswap allows individuals to create their own tokens to be tradeable on the platform. In this instance, the scammers are linking users to Uniswap to import a fraudulent $SpaceX token contract that they created.

When attempting to import the $SpaceX token, Uniswap’s interface provides a warning that it “doesn’t appear on the active token list(s)” but only cautions the user to ensure “this is the token that you want to trade.”

The walkthrough includes several screenshots on how users can swap their Ethereum tokens in exchange for the alleged $SpaceX coin. It also includes guidance on how to ensure the coins are visible within the MetaMask wallet.

At least three fake $SpaceX coins in circulation

Across the twelve websites I encountered, I observed three different contracts for $SpaceX coins. During this research, seven were pointing to the same $SpaceX token contract, which I will refer to as Alpha, while two sites, spxlaunch.com and salespacex.com, pointed to two separate $SpaceX token contracts, which I will refer to as Beta and Gamma. However, since the Alpha campaign ended on June 13, the remaining sites are now pointing to the Gamma campaign.

Swept up by a Rug Pull: How users end up holding worthless tokens

Conventional cryptocurrency scams ask users to send cryptocurrency to a specific address in order to “double” their money, which never happens. However, this scam is actually quite nefarious. It creates a sense of legitimacy through the use of a notable DEX platform like Uniswap, an actual token smart contract, and the visual confirmation of tokens appearing within a user’s MetaMask wallet. So how do users get scammed through fake tokens? It’s a concept known as a rug pull.

In order to list and facilitate the trading of the fraudulent $SpaceX coin on Uniswap, the scammers have to provide some liquidity.

Across the three token contracts I encountered, scammers provided a total liquidity of 60 Ethereum coins (20 for each contract) at a combined value of $146,300.44 at the time of funding.

As users purchase the coins on Uniswap, they add to the liquidity of the $SpaceX contract. At some point, the scammers behind this operation will remove the liquidity from the contract, thus “pulling the rug” on those who own the $SpaceX coins, making them worthless.

Honeypotting: Users locked in with their purchase of the fraudulent $SpaceX coins

Recently, a user that purchased $SpaceX coins associated with the Alpha contract, posted on the Uniswap subreddit saying they weren’t able to swap their coins back to Ethereum. This is another concept known as honeypotting in the cryptocurrency space. It is different from the traditional use of the term in the cybersecurity space, which is focused on trapping bad actors. What it means in this context is that unsuspecting users are drawn into investing in this fake $SpaceX coin, but the contract created by the scammers was designed to prevent users from being able to swap their coins back to Ethereum. The only address capable of moving funds out of the contract is the creator. So even if the scammers don’t pull the rug right away, current $SpaceX coin holders are unable to get their funds back anyway.

Scammers purposely burned coins from the contract

When these fake $SpaceX contracts were created, the scammers minted 1 billion coins (1,000,000,000) in each contract and added liquidity to the contract for 200 million (200,000,000) coins. The scammers also burned 800 million (800,000,000) $SpaceX coins for each contract by sending the coins to wallets for popular exchanges like Vb, Binance and Huobi.

Since these fraudulent $SpaceX coins aren’t listed on any of these exchanges, the coins sent to these wallets cannot be returned and are lost forever, effectively burning them from the supply. My understanding is that through burning these coins, the scammers are reducing the supply of available coins, thus driving up the perceived price of the $SpaceX coin.

Fake comments seeded on Etherscan pages

Etherscan, one of the most popular blockchain explorers for the Ethereum network, is often where cryptocurrency enthusiasts go to obtain information, such as activity related to various Ethereum-based projects. In the case of the fraudulent $SpaceX contracts, scammers have seeded the comments section of these pages with fake social proof.

The intention behind flooding these pages with fake social proof is to ensure that any comments calling out the fraudulent nature of the $SpaceX coins get lost in the noise.

Fake $SpaceX coin rug pulls have earned the scammers over $430,000 thus far, with potential to earn nearly $1 million

Across three of the fake $SpaceX contracts I encountered, two have already completed their rug pulls. The following graph shows a breakdown of the liquidity provided by the scammers, the amount of liquidity removed from the contracts and the difference (profit) they made from their scams.

At the time this blog post was published, the Alpha and Beta campaigns had ended and the Gamma campaign was still active. These figures reflect data collected up until June 21, 2021, but do not include any additional funds sent to the Alpha and Beta contract post liquidation.

The Alpha campaign began on May 22 and concluded on June 13 and netted the scammers a profit of over $403,000. Through the Beta campaign, which operated from May 29 through June 9, the scammers profited off unsuspecting users to the tune of nearly $28,000. The Gamma campaign, which began operating on June 9 and was ongoing at the time this blog post was published, has seen a high volume of activity already, earning the scammers an estimated $543,000. This means the scammers are set to make another six figure sum from this campaign once they pull the rug, bringing the total cryptocurrency they’ve stolen to nearly $1 million.

One caveat: the scammers likely send additional funds to these contracts to make them appear more legitimate so the figures listed could be partially inflated by the scammers’ own funds.

DeFi protocols are rife with rug pulls and honeypots

While DeFi protocols on Ethereum (such as Uniswap and SushiSwap) or those on the Binance Smart Chain (BSC) (like Pancakeswap) facilitate a new era of investments on the blockchain, the decentralization of these platforms means that scammers have free reign. With traditional forms of finance like banks, which are centralized, stolen funds can potentially be recaptured and returned to victims. However, on the blockchain, stolen funds are lost with little to no recourse on recovery, and in the world of DeFi, it is an unfortunate tradeoff that exists within the protocol. As a result, terms like “rug pulls” and “honeypots” have become part of the dialogue within DeFi.

The reason this particular campaign stands out is that it didn’t rely on promotion through Telegram channels or social media, but it rode the wave of success scammers have found through YouTube. It did so by leveraging the existing infrastructure of YouTube Ads to identify their target demographic of cryptocurrency enthusiasts and get their ads in front of thousands of viewers. Many new cryptocurrency investors look to YouTube channels for news and guidance, so it’s an ideal channel for promoting a fake coin.

How cryptocurrency enthusiasts can protect themselves from fraudulent coins

Remember to DYOR: Cryptocurrency enthusiasts may be familiar with the acronym DYOR, which stands for Do Your Own Research. It is a common refrain within the community for good reason. It is vital for potential investors to do their own research before investing in any asset, especially in the cryptocurrency space.

Look for cautionary signs when using a DEX: While DEXes like Uniswap and SushiSwap operate autonomously, they have put up some roadblocks for users when interacting with their services.

As I discussed earlier, Uniswap displays a limited warning about the scam token not appearing on active token lists. It also adds a banner of “Unknown Source” when displaying the address for the contract. Users should see this as a red flag before importing the token contract and swapping it for their cryptocurrency. While not every coin on Uniswap will appear on an active token list, investors should be wary of a token when they see this warning.

Be wary of fake coins for real projects: While there is no such thing as a $SpaceX coin, potential investors should also be wary of fake coins for real projects. There is a low barrier to entry to create a token contract on the Ethereum network using the same name as a real project.

We’ve today been made aware of fake $AURORA token contracts trading on Uniswap. Please be advised that there isn't any ERC-20 token associated with this project and that you will certainly lose your funds by buying into these impersonation scams. Warn others.

— Arto Bendiken (@bendiken) May 21, 2021

Look for official announcements from the creators of these projects. They will typically share details about the release of a token contract as well as what the verified contract address is prior to deployment.

When in doubt, sit this one out: There’s a pent up demand to try to capitalize gains on new and emerging coins in the cryptocurrency space. However, if you have even the slightest bit of doubt about the legitimacy of a coin or project, even after you DYOR, it’s probably best to sit this one out. The potential losses that stem from investing in fake coins and projects can be significant, so it’s better to miss out on a potential opportunity than to find yourself holding onto worthless tokens in your wallet.

Related articles

• Elon Musk and SNL: Scammers Steal Over $10 Million in Fake Bitcoin, Ethereum and Dogecoin Crypto Giveaways
• Cryptocurrency Scams: Fake Giveaways Impersonate Followers of Political and Other Notable Figures

Join Tenable's Security Response Team on the Tenable Community.

Researchers at Positive Technologies have published a proof-of-concept exploit for CVE-2020-3580. There are reports of researchers pursuing bug bounties using this exploit.

Background

On October 21, 2021, Cisco released a security advisory and patches to address multiple cross-site scripting (XSS) vulnerabilities in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software web services. In April, Cisco updated the advisory to account for an incomplete fix of CVE-2020-3581.

On June 24, Positive Technologies tweeted a proof-of-concept (PoC) exploit for CVE-2020-3580.

Shortly after, Mikhail Klyuchnikov, a researcher at Positive Technologies also tweeted that other researchers are chasing bug bounties for this vulnerability. Tenable has also received a report that attackers are exploiting CVE-2020-3580 in the wild.

Analysis

All four vulnerabilities exist because Cisco ASA and FTD software web services do not sufficiently validate user-supplied inputs. To exploit any of these vulnerabilities, an attacker would need to convince “a user of the interface” to click on a specially crafted link. Successful exploitation would allow the attacker to execute arbitrary code within the interface and access sensitive, browser-based information.

These vulnerabilities affect only specific AnyConnect and WebVPN configurations:

Proof of concept

As mentioned earlier, there is a public PoC published by Positive Technologies on Twitter, which has gained significant attention.

Vendor response

Cisco has not issued any additional information or updates since the PoC was published. We will monitor and update this blog post if that changes.

Solution

With this new information, Tenable recommends that organizations prioritize patching CVE-2020-3580.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

• Cisco Advisory for Multiple XSS Vulnerabilities in Cisco ASA and FTD
• Positive Technologies PoC Tweet for CVE-2020-3580

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Engineering, human resources, product management and billing: Here's how four employees with a wide range of skills are making their mark in cybersecurity.

At Tenable, we're united in a common mission: to help organizations around the world reduce their cyber risk. While the mission requires a formidable engineering bench, you don't need to be a techie to make a difference in cybersecurity. 

By embracing diversity of skill sets and experiences,  team Tenable is empowered to meet the challenge of our expanding threat landscape. We're people first. We're analysts, creatives, engineers, and more. The causes we champion, hobbies we nurture and the people we love make us better teammates. If you're passionate about reducing cyber risk and making the world a safer place, you have a role to play at Tenable. 

Meet four of our best and brightest from across the organization to learn about their accomplishments, personal interests and advice for hopeful applicants. Read their stories and envision where you will fit into Team Tenable.

Leading with inclusion on Tenable's security engineering team

"I joined Tenable right out of college. I enjoyed using Nessus Professional during my studies and decided to apply. My favorite parts of working here have been the employees and the feeling of community, or what we call One Tenable. We create opportunities to work together across departments and I've made meaningful connections with my colleagues. Now, I'm glad to make a more profound impact on our team as co-leader of our Pride@Tenable employee resource group. It's Pride Month in the U.S., so it's been rewarding to host special events and share resources for our LGBTQIA+ employees and allies. 

"Outside of work, I love to bake sweets because dessert in the oven is one of the best smells!

"If you're interested in joining Tenable, my advice would be to be a team player and stay open to new ideas. Collaboration is the cornerstone of what makes Tenable a great place to work."

— Kevin Wen, security engineer

Following your passion on Tenable's human resources team

"I was looking for a place where I could be myself and feel accepted. I wanted an environment where I could expand my knowledge and skills. I was excited to join Tenable and find that I could challenge myself as part of a larger HR team. I recently received recognition for creating the Green Initiatives program to bring employees together in the name of living a greener, more sustainable lifestyle. I've received support and guidance from my supervisor and other senior leaders at Tenable on this passion project. It means a lot because, although it isn't part of my regular HR work here, they could tell it was something I believed in and encouraged me.

"In my free time, I love being out in nature with my daughter, showing her all the wonders and watching her absorb knowledge in her own way. Work-life balance is important to me. At Tenable, I work hard, but not at the expense of enjoying the people and things I love.

"To those who want to join our team, be open to tackling new problems because it will only help you grow. Apply today!"

— Mia Liccini Ramos, HR business partner

Driving innovation on Tenable's product management team

"I was ready for a change after 15 years of experience building products in the digital media industry. Tenable appealed to me because of its mission to prevent cyberattacks. Given how much of our lives and information are digital today, it's scary to think about the consequences of companies not taking information security protections seriously.

"I'm proud of the work my team and I have done around customer experience and education. We've been focused on enhancing our products by providing helpful resources to streamline the onboarding process for our customers and bolster their growth. I'm also excited to co-lead our Women@Tenable group and expand the community of women and our allies at Tenable. It's great to see women in technical fields, and I'd love to see more women advance in leadership roles. I've relished working with smart, motivated and innovative people who care about what we do here. The people make the team, and the team is what makes Tenable so great.

"For leisure, I love being outdoors. In the winter, you'll find me on the ski slopes — hopefully somewhere in the Rocky Mountains. And in the summer, you'll find me mountain biking, hiking, running or playing with my kids at the swimming pool.

"If you're curious about joining Tenable, visit our website to learn more about vulnerability management and cybersecurity in general. Download Nessus Essentials (it's free!).

— Marianne Gutshall, director of product management

Making a successful career change with Tenable's billing operations team

"I was working as a manager at Wegmans Food Market and looking to make a career pivot. I wanted to spend more time with friends and family while working for an industry-leading company making a real-world impact. As a kid, I always loved the latest and greatest tech and dreamed of working for a technology company one day. Seeing the rapid growth of cybersecurity, it was a no-brainer to apply to Tenable. Now, I can confidently say it's been one of the best life decisions I've made to join Team Tenable!

"My proudest achievement here is winning a team award for innovation. I suggested implementing automations to increase productivity in my department and created lasting business relationships that have furthered our growth. I've also been promoted several times, including a new cross-departmental move that I'm excited to start in July. My favorite thing about my experience here is that I feel heard. Tenable gives employees regular opportunities and various avenues to share feedback, ask questions and learn from executives. Consistent communication makes everyone feel like they have a place and a voice within the organization.

"Beyond work hours, I spend time recording my podcast, Oh Boy! (Listen on Apple, Spotify, and Anchor). My cousin and I talk all things Disney World, sharing our favorite eateries, attractions and travel tips.

"For those interested in joining Tenable, never be afraid to reach for the stars. Tenable wants to see employees grow and promotes from within when opportunities arise."

— Tom Bandini, senior manager, billing operations

Learn More

• Visit our Tenable Careers page and view open positions
• Follow Life at Tenable on Instagram
• Learn more about Tenable's The Washington Post ‘Top Workplaces' Award

Researchers published and deleted proof-of-concept code for a remote code execution vulnerability in Windows Print Spooler, called PrintNightmare, though the PoC is likely still available.

Background

At the end of June, two different research teams published information about CVE-2021-1675, a remote code execution (RCE) vulnerability in the Windows Print Spooler that has been named PrintNightmare.

When it was originally disclosed in the June Patch Tuesday update, it was described as a low severity elevation of privilege vulnerability. That designation was updated on June 21 to indicate a critical severity and the potential for RCE. Discovery was credited to Zhipeng Huo of Tencent Security Xuanwu Lab, Piotr Madej of AFINE and Yunhai Zhang of NSFOCUS TIANJI Lab.

On June 27, the research team at QiAnXin tweeted a GIF demonstrating successful exploitation of CVE-2021-1675 to gain RCE without any technical details or proof-of-concept (PoC) code.

Recently, we found right approaches to exploit #CVE-2021-1675 successfully, both #LPE and #RCE. It is interesting that the vulnerability was classified into #LPE only by Microsoft, however, it was changed into Remote Code Execution recently.https://t.co/PQO3B12hoEpic.twitter.com/kbYknK9fBw

— RedDrip Team (@RedDrip7) June 28, 2021

On June 29, researchers at a different firm, Sangfor, published a full technical write-up with PoC code to GitHub. That repository, however, was taken down after only a few hours. It is unclear if the researchers decided to share their PoC because of the tweet from QiAnXin. The researchers claim to have discovered this vulnerability independently from those credited with the disclosure by Microsoft.

We deleted the POC of PrintNightmare. To mitigate this vulnerability, please update Windows to the latest version, or disable the Spooler service. For more RCE and LPE in Spooler, stay tuned and wait our Blackhat talk. https://t.co/heHeiTCsbQ

— zhiniang peng (@edwardzpeng) June 29, 2021

While they did not explicitly confirm the reason for removal of the PoC, it appears the researchers were concerned about giving too much information away publicly before their upcoming Black Hat USA presentation on this vulnerability.

Unfortunately, the GitHub repository was publicly available long enough for others to clone it. The PoC is likely still circulating and is likely to resurface publicly, if it hasn’t already done so.

Analysis

Exploitation of CVE-2021-1675 could give remote attackers full control of vulnerable systems. To achieve RCE, attackers would need to target a user authenticated to the spooler service. Without authentication, the flaw could be exploited to elevate privileges, making this vulnerability a valuable link in an attack chain.

Windows Print Spooler has a long history of vulnerabilities and its ubiquity can allow for serious impact on targets. Most notably, Print Spooler vulnerabilities were tied to the Stuxnet attacks over a decade ago. More recently, CVE-2020-1337 was a zero-day in print spooler disclosed at last year’s Black Hat and DEF CON events, which happened to be a patch bypass for CVE-2020-1048, another Windows Print Spooler vulnerability that was patched in May 2020.

Solution

CVE-2021-1675 was patched as part of Microsoft’s Patch Tuesday release on June 8, 2021. Vulnerabilities like this are most likely to be used in targeted attacks, but all users and organizations are encouraged to patch quickly.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability can be found here.

Get more information

• Microsoft Advisory for CVE-2021-1675

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Reducing the time required to move from vulnerability assessment to remediation is a never ending challenge for most organizations. Here's how the integration between Tenable and HCL BigFix can help you quickly correlate vulnerabilities and patches to reduce risk.

It's no secret that organizations are faced with an onslaught of vulnerabilities every day. In fact, organizations are struggling to remediate their most critical vulnerabilities. The majority of breach victims (60%) said they were breached due to an unpatched known vulnerability where the patch was not applied. In this blog, we address the challenges faced by organizations as they look to streamline the process of finding and fixing vulnerabilities and explore how the integration between Tenable and HCL BigFix can help.

Traditionally, organizations think of the attack surface as being only limited to employee workstations, servers and desktops. But, over the years and with the emergence of new technologies, the attack surface has expanded to include web applications, cloud assets, operational technology (OT) environments, mobile devices and a massive shift of employees working from home and using their own devices. Yet, most security teams have only a fragmented view of their entire attack surface. This, in turn, means they're only able to provide incomplete guidance, at best, to the IT teams responsible for remediation. Ultimately, this leads to wasted time and resources and limits the organization's ability to effectively reduce its cyber risk.

How organizations are managing and remediating vulnerabilities today with existing tools

To continue the story, we need to understand how security and IT teams are working to reduce cyber risk with their current tools.

Source: Tenable

In the above diagram, we see how the security team and the IT operations team work together using traditional tools to remediate vulnerabilities. Security professionals assess the network using one or more vulnerability scanning tools and then compile the results from these various sources. When the vulnerabilities are gathered, each vulnerability needs to be assessed to determine which ones pose the greatest risk.

 How? In most organizations, the process generally relies on Common Vulnerability Scoring System (CVSS) scores, which do not give the full breadth and depth of the potential risk posed to the organization. For example, 56% of the more than 18,000 vulnerabilities disclosed in 2020were classified as having high or critical severity. The sheer volume leaves mounds of work for security pros as they look to identify those which pose the greatest risk to the organization. Then, each of these vulnerabilities has to be manually researched for additional context, a process which can be extremely lengthy and error prone.

Once the security team has consolidated the vulnerability findings into a working excel sheet or other document, it's typically sent to the IT operations team to deploy patches. The list is usually sent to IT via email, through a shared collaboration tool like Slack or, in the more sophisticated organizations, by a basic ticketing system. At best, these manual documents only illustrate the ‘point in time' risk of a particular vulnerability. Most basic ticketing systems only automate the routing of the vulnerabilities and do nothing to solve the prioritization and remediation correlation problems. Making matters worse, in most cases, the IT operations team only receives the data on a weekly, monthly or even quarterly basis.

Tenable + HCL Integration Overview

The integration between Tenable and HCL BigFix enables organizations to see everything, predict what matters and act to address risk. The result? They can utilize the best of both breeds in a single dashboard, accessing Tenable's vulnerability coverage, paired with Predictive Prioritization, to focus on what matters most, combined with BigFix to automatically correlate the right remediation to the right vulnerability.

Source: Tenable

With this integration, the burden of manually looking up each vulnerability on a static spreadsheet and then trying to match the vulnerabilities and their affected hosts with the most up-to-date patch is radically reduced.

The combined capabilities of Tenable and HCL BigFix can drastically improve an organization's overall security posture by reducing mean time for remediation and patch workflows. Organizations have confidence in knowing they are able to effectively and efficiently prioritize remediation of the vulnerabilities most critical to their business, fast-tracking their ability to reduce risk.



Source: Tenable

The above screenshot is an example of how security teams can view Tenable vulnerabilities with appropriate fixlets within the BigFix Insights vulnerability remediation dashboard. The data can be displayed as:

• a pie chart showing the top 5 vulnerabilities by devices with a filter for Tenable's Tenable's Vulnerability Priority Rating (VPR) or Asset Criticality Rating (ACR);

• a breakdown of vulnerabilities by Tenable's VPR; and

• a timeline breakdown of when the vulnerability was first detected or published based on CVSS or VPR. 


Users can drill down further to get details on the vulnerability, affected devices and BigFix Fixlet.

Source: Tenable

The screenshot above provides a view of results filtered by Tenable VPR score, which security and IT teams can use to determine which vulnerabilities pose the highest risk. This dashboard example also shows the appropriate BigFix Fixlet Title and ID to push those patches. This information is up to date on a daily basis and always shows the most recent patch to apply, eliminating the need for spending time manually matching.

Learn more about Tenable and HCL Big Fix

• In this ESG publication, Dave Gruber, senior analyst at ESG, takes a closer look at the vulnerability management and remediation challenges organizations face and dives into how security teams can dramatically save time and reduce manual efforts with BigFix Insights Vulnerability Remediation. For more detailed information on this integration, check out our demo overview video and our solution overview or contact us to get started.
• HCL is a strategic partner within Tenable's Technology Ecosystem, which contains over 90 partners and 180+ unique integrations. The breadth and depth of Tenable's ecosystem helps joint customers improve their security programs by combining Tenable's market-leading risk-based vulnerability management solutions with other security applications in their environment. This "better together" approach, by combining the best of both breeds with Tenable and HCL, helps serve and strengthen security programs of all sizes around the world.

Zero-day vulnerabilities in popular remote monitoring and management software targeted by threat actors to distribute ransomware to reportedly over one million systems.

Update July 6, 2021: Tenable is not impacted by the recent supply chain ransomware attack. We do not use Kaseya VSA, so our products and infrastructure are not vulnerable to the zero days used in the attack.

Background

On July 2, reports emerged that a number of companies whose networks are administered by managed service providers (MSPs) using Kaseya Virtual System Administrator (VSA), a remote monitoring and management (RMM) software from Kaseya Limited, became the victims of a large-scale ransomware attack.

The attacks have been attributed to REvil, also known as Sodinokibi, one of the most active ransomware groups today. REvil operates as a ransomware-as-a-service (RaaS), whereby they develop the ransomware payload itself and provide the infrastructure for managing victim communications for negotiating payment and distribution of decryption tools for victims post payment.

Image Source: Mark Loman (Twitter)

REvil does not attack organizations directly, rather they rely on affiliates, who do the dirty work to break into networks and deploy the ransomware. Affiliates receive a large portion of the ransom payment, while REvil takes a percentage for providing the ransomware and supporting infrastructure.

Similar to many other ransomware groups, REvil operates a leak website, where they publish the names of their victims along with a sampling of files they exfiltrated from the victim’s network. This is part of a tactic known as double extortion, which was pioneered by the Maze ransomware group in late 2019. Through double extortion, ransomware groups have seen their profits skyrocket, which has led to more activity in the space, and subsequently fueled the number of attacks.

Analysis

On July 5, Kaseya confirmed that multiple zero-day vulnerabilities were used to target vulnerable VSA server instances, including an authentication bypass flaw and an arbitrary command execution vulnerability. No specific details about the vulnerabilities were shared at the time and no additional CVEs have been reported.

Separately, researchers at Huntress Labs and TrueSec have identified potentially three zero-day vulnerabilities used as part of investigations into attacks against their clients, including:

1. Authentication Bypass Vulnerability
2. Arbitrary File Upload Vulnerability
3. Code Injection Vulnerability

Huntress Labs, for example, believes the attackers were able to gain access to VSA servers through the use of the authentication bypass flaw.

“[...] we have high confidence that the threat actor used an authentication bypass in the web interface of Kaseya VSA to gain an authenticated session, upload the original payload, and then execute commands via code injection.”

In a later update from Huntress Labs, new evidence suggests that SQL injection may not have been the complete attack vector leading to code execution and another injection attack may be part of the attack chain.

Coordinated disclosure of zero-day vulnerabilities

On July 4, researchers at the Dutch Institute for Vulnerability Disclosure (DIVD) Computer Security Incident Response Team (CSIRT) published a blog post saying they’ve been working with Kaseya to coordinate the disclosure of “a number of zero-day vulnerabilities” in Kaseya VSA. They highlighted CVE-2021-30116, a vulnerability that they say is being used in these ransomware attacks, though they did not provide any further details about the other vulnerabilities. We suspect that these include the arbitrary file upload and code injection flaws.

While there has not been a direct confirmation, we assume that CVE-2021-30116 may be the authentication bypass vulnerability called out by Huntress Labs and TrueSec.

REvil publishes notice on their leak website

On July 4, REvil published a post to their leak website, confirming that they were behind the attack against Kaseya.

In the posting, REvil claims they have infected “more than a million systems” through this campaign and that they are willing to offer a universal decryptor tool for $70 million in Bitcoin, which could be used by any organization to decrypt files on systems that were struck by the REvil ransomware. If the number of systems infected is confirmed to be true, this attack would be considered the largest ransomware attacks ever conducted since the WannaCry ransomware attack in 2017.

Not the first time RMM tools have been targeted by ransomware groups

Over the last few years, threat actors have identified MSPs and RMMs as valuable targets for distributing ransomware to an MSP’s downstream customers. In February 2019, the GandCrab ransomware group exploited a two-year old vulnerability in the ConnectWise plugin for Kaseya VSA, which affected 126 Kaseya customers.

In December 2019, threat actors targeted an MSP and used the ConnectWise Control RMM software to distribute the Zeppelin Ransomware to the MSP’s downstream customers.

Because many organizations rely on MSPs to remotely monitor and manage their IT systems, and with the impact the attack against Kaseya VSA has had, we believe other ransomware groups will continue to look for flaws in other RMM software.

Proof of concept

At the time this blog post was published, there were no public proof-of-concept exploits for any of the vulnerabilities in Kaseya VSA.

Vendor response

Following the discovery of the vulnerability, Kaseya has been sharing updates for customers and other interested parties on their website. Kaseya proactively shut down their software-as-a-service (SaaS) servers while they investigated the attack, though they do not believe the attackers targeted SaaS customers. It appears the impacted organizations used Kaseya VSA on-premises.

Solution

Kaseya has stated that a patch has been developed and is undergoing “testing and validation” prior to being released to customers. SaaS servers are expected to be brought back online on July 6th between 2:00 PM – 5:00 PM EDT and the patch for on-premise customers is expected to be released within 24 hours after their SaaS servers are online. For the most up-to-date information, please refer to Kaseya's update page.

Because the attack appears to have impacted Kaseya VSA on-premise customers, Kaseya has instructed those customers to shut down their VSA servers until a patch is available.

Identifying affected systems

Tenable has released a local Windows detection for Kaseya agents as well as a remote detection plugin for Kaseya VSA. When patches are available, we will update this blog with links to our version check plugin.

Get more information

• Reuters Report on Kaseya Ransomware Attack
• Kaseya Updates Regarding VSA Security Incident
• Huntress Labs Rapid Response: Mass MSP Ransomware Incident
• TRUESEC Blog on Kaseya Supply Chain Attack

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Microsoft issues an out-of-band patch for critical ‘PrintNightmare’ vulnerability following reports of in-the-wild exploitation and publication of multiple proof-of-concept exploit scripts

Background

On July 6, Microsoft updated its advisory to announce the availability of out-of-band patches for a critical vulnerability in its Windows Print Spooler that researchers are calling PrintNightmare. This remote code execution (RCE) vulnerability affects all versions of Microsoft Windows.

*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on July 7 and reflects VPR at that time.

Microsoft originally released its advisory for CVE-2021-34527 on July 1. This advisory was released in response to public reports about a proof-of-concept (PoC) exploit for CVE-2021-1675, a similar vulnerability in the Windows Print Spooler. To help clear up confusion about the vulnerability, Microsoft updated its advisory for CVE-2021-1675 to clarify that it is “similar but distinct from CVE-2021-34527.”

Analysis

CVE-2021-34527 is an RCE vulnerability in the Windows Print Spooler Service, which is available across desktop and server versions of Windows operating systems. The service is used to manage printers and print servers. The vulnerability exists because the service does not handle privileged file operations properly.

An authenticated, remote or local attacker, could exploit this flaw in order to gain arbitrary code execution with SYSTEM privileges.

Research community actively developing PoC exploits for PrintNightmare

Since July 1, researchers have been diligently developing PoCs for PrintNightmare. At the time this blog post was published, there were at least 34 public PoC exploit scripts for PrintNightmare on GitHub.

These PoCs include scripts that can achieve local privilege escalation (LPE) on a targeted system, as well as remote code execution.

Previous PoCs relied on the Microsoft Print System Remote Protocol (MS-RPRN) to exploit PrintNightmare. However, on July 3, a researcher going by the nickname cube0x0, developed a PoC called SharpPrintNightmare, which uses the Microsoft Print System Asynchronous Remote Protocol (MS-PAR) instead, which confirmed that PrintNightmare could be successfully exploited against servers and desktop systems as well as domain controllers.

Disabling spooler on just your DC's is not enough #PrintNightmarepic.twitter.com/IJJ2S2Ejxs

— Cube0x0 (@cube0x0) July 3, 2021

Benjamin Delpy, developer of the comprehensive post-exploitation tool Mimikatz, updated the software to add support for the PrintNightmare exploit using cube0x0’s method.

Researchers say Microsoft’s patch is incomplete

At the time this blog post was published, several researchers including Kevin Beaumont, Will Dormann and Hacker Fantastic, have pointed out that the fix for PrintNightmare is incomplete, as the LPE still works successfully post-patch, both “out of the box” as well as under certain configurations.

Additionally, there are reports that both RCE and LPE is still feasible post-patch, so long as the Point and Print configuration is enabled.

Tenable has not independently confirmed these findings.

Proof of concept

As mentioned above, there are a number of PoC exploit scripts for PrintNightmare available on GitHub.

Solution

As of July 7, Microsoft released patches for a number of different Windows releases. The following table can be used to reference each patch and its associated knowledge base entry.

Microsoft updated its advisory on July 7 to address the Point and Print aspect of this vulnerability. Specifically, they mention that while Point and Print is “not directly related to this vulnerability” its usage “weakens the local security posture” allowing for exploitation even if patches have been applied.

To mitigate Point and Print, Microsoft recommends adding the following keys to the Windows registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
NoWarningNoElevationOnInstall = 0 (DWORD)
NoWarningNoElevationOnUpdate = 0 (DWORD)

Note: These keys do not exist in the registry by default and must be added to disable Point and Print for non-administrative users.

Additionally, Microsoft Security Response Center released a blog post to announce that the cumulative patch released for CVE-2021-34527 also includes a new feature that provides users with the ability to allow non-administrative users to only install signed printer drivers which are trusted by “the installed root certificates in the system’s Trusted Root Certification Authorities”. More information on these enhanced security controls can be found in Microsoft KB5005010.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released. Customers can also utilize plugin ID 151440 to identify systems which have the print spooler service (spoolsv.exe) enabled.

Get more information

• Microsoft Advisory for CVE-2021-34527
• Microsoft Security Response Center Blog Post for CVE-2021-34527
• Tenable Blog Post for CVE-2021-1675

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.