Microsoft has issued patches for several critical vulnerabilities in all supported Windows versions that require urgent attention to prevent exploitation. While there have been no reports of exploitation of the flaws in the wild, the seriousness of the vulnerabilities and their potential to be weaponized has prompted both the Department of Homeland Security (DHS) and the Department of Health and Human Services (HHS) to issue emergency directives about the vulnerabilities.

One of the vulnerabilities was discovered by the National Security Agency (NSA), which took the unusual step of reporting the vulnerability to Microsoft. This is the first time that a vulnerability has been reported by the NSA to a software vendor.

Windows CryptoAPI Vulnerability Requires Immediate Patching

The NSA-discovered vulnerability, tracked as CVE-2020-0601, affects Windows 10 and Server 2016/2019 systems. The vulnerability is due to how the Windows CryptoAPI validates Elliptic Curve Cryptography (ECC) certificates. The flaw would allow a remote attacker to sign malicious code with an ECC certificate to make it appear that the code has been signed by a trusted organization.

The vulnerability could also be exploited in a man-in-the-middle attack. Malicious certificates could be issued for a hostname that did not authorize it and applications and browsers that rely on the Windows’ CryptoAPI would not issue any warnings or alerts. A remote attacker could exploit the flaw and decrypt, modify, or inject data on user connections undetected.

There are no reported cases of exploitation of the vulnerability, but the NSA believes it will not take long for advanced persistent threat (APT) groups to understand the underlying flaw and weaponize the vulnerability, hence the decision to report the flaw to Microsoft.

According to the NSA, “The consequences of not patching the vulnerability are severe and widespread. Remote exploitation tools will likely be made quickly and widely available. Rapid adoption of the patch is the only known mitigation at this time and should be the primary focus for all network owners.”

Critical RCE Vulnerabilities in Windows Remote Desktop

Three pre-authentication vulnerabilities in Windows Remote Desktop have been patched by Microsoft. Two of the vulnerabilities – CVE-2020-0609 and CVE-2020-0610 – could allow a remote attacker to connect to servers and remotely execute arbitrary code without any user interaction. After exploiting the flaws they could install programs, view, change, or delete data, or create new accounts with full admin rights. The flaws could be exploited by sending a specially crafted request to a vulnerable server.

The third vulnerability – CVE-2020-0612 – could be exploited in a similar fashion and could allow an attacker to perform a denial of service attack and crash the RDP system.

The vulnerabilities are present in the RDP Gateway Server and Windows Remote Desktop Client and affect all supported versions of Windows and Windows Server.

Emergency Directives Issued by DHS and OCR

The Department of Homeland Security has determined the vulnerabilities to pose an unacceptable risk to the Federal enterprise and has issued an emergency directive (20-02) to all federal agencies calling for the patches to be applied on all affected endpoints within 10 business days and for technical and/or management controls to be put in place for newly provisioned or previously disconnected endpoints.

The seriousness of the vulnerabilities has prompted the HHS’ Office for Civil Rights to issue an emergency directive of its own to the healthcare industry and public sector. All healthcare and public health entities have been advised to apply the patches as soon as possible to ensure the vulnerabilities are not exploited.

The post Emergency Directives Issued by CISA and OCR to Mitigate Critical Windows Vulnerabilities appeared first on HIPAA Journal.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a recently discovered vulnerability in the Citrix Application Delivery Controller and Citrix Gateway web server appliances.

Exploitation of the vulnerability – tracked as CVE-2019-19781 – is possible over the internet and can allow remote execution of arbitrary code on vulnerable appliances. Exploitation of the flaw would allow a threat actor to gain access to the appliances and attack other resources connected to the internal network. Some security researchers have described the bug as one of the most dangerous to be discovered in recent years.

The alert, issued on January 8, 2019, urges all organizations using the affected Citrix appliances (formerly NetScaler ADC and NetScaler Gateway) to apply mitigations immediately to limit the potential for an attack, and to apply the firmware updates as soon as they are released later this month.

Two proof of concept exploits have already been published on GitHub which makes exploitation of the flaws trivial. Scans for vulnerable systems have increased since the publication of the exploits on Friday by Project Zero India and TrustedSec and attacks on honeypots setup by security researchers have increased in frequency over the weekend.

Worldwide there are approximately 80,000 companies in 158 countries that need to apply mitigations to correct the vulnerabilities. Approximately 38% of vulnerable organizations are located in the United States.

The flaws are present in all supported versions of the Citrix Application Delivery Controller and Citrix Gateway web server – versions 13.0, 12.1, 12.0, 11.1, and 10.5 – which include Citrix NetScaler ADC and NetScaler Gateway.

The path traversal bug was discovered by UK security researcher Mikhail Klyuchnikov who reported it to Citrix. The flaw can be exploited over the internet on a vulnerable appliance without the need for authentication. All that is required to exploit the flaw is to find a vulnerable appliance and send a specially crafted request along with the exploit code.   The bug is being referred to as Shitrix by security researchers on cybersecurity forums.

Currently there is no patch available to correct the flaw. Citrix will be issuing a firmware upgrade later this month to correct the vulnerability, which is currently scheduled for release on January 20, 2020 for firmware versions 11.1 and 12.0, January 27, 2020 for versions 12.1 and 13.0, and January 31, 2020 for version 10.5.

In the meantime, it is essential for configuration changes to be applied to make it harder for the vulnerability to be exploited. These can be found on Citrix Support Page CTX267679.

Since the flaw is currently under active attack, after applying mitigations it is important to check to make sure the flaw has not already been exploited.

TrustedSec, which held back on publishing its PoC exploit code until an exploit had already been released on GitHub, has developed a tool that can be used to identify vulnerable Citrix instances on networks and has published potential indicators of compromised Citrix hosts.

The post DHS Warns of Critical Citrix Vulnerability Being Exploited in the Wild appeared first on HIPAA Journal.

Last week, the Federal Bureau of Investigation (FBI) issued a flash alert warning private companies in the United States about the threat of attacks involving Maze ransomware. The warning came just a few days after the FBI issued an alert about two other ransomware variants, LockerGoga and MegaCortex.

The Maze ransomware TLP: Green warning is not intended for public distribution as it provides technical details about the attacks and indicators of compromise which can be used by private firms to prevent attacks. If published in the public domain, it could aid the attackers.

In the alert, victims of Maze ransomware attacks were urged to share information with the FBI as soon as possible to help its agents trace the attackers and bring them to justice.

Maze ransomware was first identified in early 2019, but it was not until November 2019 when the first attacks hit companies in the United States. Those attacks have been increasing in recent weeks.

When network access is gained, data is exfiltrated prior to file encryption. A ransom demand is then issued specific to the organization. The attackers claim they will supply the keys to decrypt files and will destroy all data they stole in the attack. The attackers warn their victims that if payment is not made before the deadline is reached, they will start publishing the stolen data.

Maze ransomware was used in a recent attack on the City of Pensacola. When the ransom was not paid the attackers started publishing the stolen data. In December, the Carrollton, GA-based wire and cabling firm, Southwire, was attacked with Maze ransomware. An 850 BTC ($6 million) ransom demand was issued for the keys to decrypt files. The attackers said they had stolen data and threatened to publish it if the ransom was not paid. When no payment was received, the attackers created a website with an Irish ISP and started publishing the data.

Southwire successfully obtained a court injunction in Ireland forcing the ISP to take down the website that was being used by the Maze gang to publish its data. That website is now offline. Southwire also filed a lawsuit against the hackers in federal court in Georgia. Southwire alleges violations of the U.S. Computer Fraud and Abuse Act and is seeking injunctive relief and damages. Since the attackers are unknown, the lawsuit was filed against ‘John Doe.’

According to CyberScoop, which obtained a copy of the FBI alert, the threat actors use a variety of methods to attack businesses, including malicious cryptocurrency websites, malspam and phishing campaigns impersonating government agencies and security vendors, and ransomware downloads via exploit kits such as Fallout.

The FBI has urged private companies in the United States to heed its warning and take steps to strengthen their defenses and address vulnerabilities. In the event of an attack, the FBI does not recommend paying the ransom as there is no guarantee that valid keys to decrypt data will be supplied or that the stolen data will be destroyed.

The post FBI Issues Alert as Maze Ransomware Attacks Increase in the U.S. appeared first on HIPAA Journal.

The FBI has issued a TLP:Amber alert in response to a spate of cyberattacks involving the ransomware variants LockerGaga and MegaCortex. The threat actors using these ransomware variants have been targeting large enterprises and organizations and typically deploy the ransomware several months after a network has been compromised.

LockerGaga was first detected in January 2019 and MegaCortex ransomware first appeared in May 2019. Both ransomware variants exhibit similar IoCs and have similar C2 infrastructure and are both used in highly targeted attacks on large corporate networks.

LockerGaga was used in the ransomware attacks on the U.S. chemical companies Hexion and Momentive, the aluminum and energy company Norsk Hydro, and the engineering consulting firm, Altran Technologies. MegaCortex ransomware was used in the attacks on the accounting software firm Wolters Kluwer and the cloud hosting firm iNSYNQ, to name but a few. The threat actors are careful, methodical, and attempt to cause maximum damage to increase the probability that their victim’s will pay. The ransom demands are often of the order of hundreds of thousands of dollars or more.

The initial compromise is achieved through a variety of methods including the exploitation of unpatched vulnerabilities, phishing attacks, SQL injection, brute force tactics on RDP, and the use of stolen credentials. Once compromised, the attackers run batch files to stop processes and services used by security solutions to ensure their presence is not detected. The attackers move laterally to compromise as many devices as possible using a penetration testing tool named Cobalt Strike, living-of-the-land Windows binaries, and legitimate software tools such as Mimikatz. A beacon is added to each compromised device on the network, which is used to execute PowerShell scripts, escalate privileges, and spawn a new session to act as a listener on the victim’s system, according to the FBI warning, as reported by Bleeping Computer which obtained a copy of the alert.

In contrast to many other threat actors who deploy ransomware soon after a system is compromised, the threat actors behind these attacks often wait several months before the ransomware encryption routine is triggered. It is unclear what the threat actors do during that time, but it is likely the time is used to steal sensitive data. The ransomware is deployed in the final stage of the attack once all useful data has been obtained from the victims.

The advice offered by the FBI to improve defenses is standard for preventing ransomware and other cyberattacks. Cybersecurity best practices should be followed, including backing up data regularly; storing backup copies on non-networked devices; testing backups to ensure file recovery is possible; setting strong passwords; patching promptly; enabling multi-factor authentication, especially on admin accounts; ensuring RDP servers can only be accessed via a VPN; disabling SMBv1; and to scan for open ports and block them to prevent them from being accessible.

The FBI also recommends auditing the creation of new accounts and monitoring Active Directory for changes to authorized users; enabling PowerShell logging and monitoring for unusual commands, including the execution of Base64 encoded PowerShell; and ensuring only the latest version of PowerShell is installed.

The post FBI Issues Warning Following Spate of LockerGaga and MegaCortex Ransomware Attacks appeared first on HIPAA Journal.