Reports from security researchers Kevin Beaumont and Marcus Hutchins have shed light on the recent BlueKeep attacks that installed cryptocurrency miners on compromised devices . In early November, Beaumont noticed that his honeypots, which were set up to detect and monitor BlueKeep attacks, kept crashing. A probe into the source of the crashes confirmed that it was caused by the BlueKeep exploit module for the Metasploit penetration testing framework. These blue screen of death (BSOD) crashes in the honeypots were actually the issues that helped Beaumont discover the real-world attacks.
Investigating these events, Microsoft found connections between attacks from late October and a campaign from last September — the attacks were likely deployed by the same group. This prompted concern and warnings of more incoming attacks . BlueKeep is a known remote code execution vulnerability affecting Remote Desktop Protocol (RDP) services on Windows 7, Windows Server 2008, and Windows Server 2008 R2. It was patched by Microsoft in May . Microsoft has consistently urged administrators to patch their RDP services to help defend against exploits of this vulnerability.
As mentioned above, Beaumont’s BlueKeep honeypots were crashing and rebooting. The exploit kept triggering BSOD crashes, signaling its instability. Further investigation from Microsoft revealed that the BlueKeep exploit attempts “ involved human operators aiming to penetrate networks ,” meaning that the malware is not a self-propagating worm. The ‘wormability’ issue was one that researchers were concerned about when the BlueKeep exploit was first released in September. Microsoft posits that attackers are likely using manual port scans to find vulnerable machines.
According to security researcher Sean Dillon , the BSOD was triggered because the exploit was not compatible with the patches Microsoft issued for the Meltdown Intel CPU vulnerability. However, there are plans to update the BlueKeep Metasploit exploit to support kernels patched for Meltdown . Unfortunately, this means that attackers will have a better chance of compromising vulnerable systems — they can rely on a more stable exploit, made less obvious because it will not cause the BSOD.
Wormability is not the most pressing concern when it comes to BlueKeep, as highlighted by Hutchins ; the real concern is the possibility of servers being compromised. Most devices vulnerable to BlueKeep are actually servers, and a compromised server makes it easy for attackers to pivot and spread internally within a network. He points out that Windows servers usually control other devices on the network, they are either domain admin, have network management tools installed, or share the same local admin credentials with the rest of the network.
Regrettably, even with reports of active exploits for BlueKeep hitting honeypots, system administrators remained unmotivated to patch. Researchers in the SANS Institute have been tracking the rate of patching through Shodan and have noticed a downward slope in the rate of patching since May . The recent media reports of attacks did nothing to change the trajectory.
Here are some best practices that can help users and enterprises reduce their exposure to threats that may exploit BlueKeep:
The Trend Micro™ Deep Security™ and Vulnerability Protection solutions protect systems and users from threats targeting CVE-2019-0708 via this Deep Packet Inspection (DPI) rule:
Trend Micro™ TippingPoint® customers are protected from threats and attacks that may exploit CVE-2019-0708 via this MainlineDV filter:
Like it? Add this infographic to your site:1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
In the first half of this year, cybersecurity strongholds were surrounded by cybercriminals waiting to pounce at the sight of even the slightest crack in defenses to ravage valuable assets. View the report
The upheavals of 2020 challenged the limits of organizations and users, and provided openings for malicious actors. A robust cybersecurity posture can help equip enterprises and individuals amid a continuously changing threat landscape. View the 2020 Annual Cybersecurity Report
paypal dumps buy fullz cvv
