Remember the panic that hit organisations around the world on May 12th, 2017 when machine after machine displayed the WannaCryptor ransom screen? Well, we might have a similar incident on our hands in the coming days, weeks or months if companies don’t update or otherwise protect their older Windows systems right away. The reason is BlueKeep, a ‘wormable’ critical Remote Code Execution (RCE) vulnerability in Remote Desktop Services that could soon become the new go-to vector for spreading malware, says Carey van Vlaanderen, CEO at ESET South Africa.
A patch by Microsoft for supported, as well as some unsupported, operating systems has been available since May 14th
The BlueKeep vulnerability was found in Remote Desktop Services (also known as Terminal Services). If successfully exploited in the future, it could enable access to the targeted computer via a backdoor with no credentials or user interaction needed.
To make the bad news even worse, the vulnerability is ‘wormable’. This means that future exploits might use it to spread malware within or outside of networks in similar ways to what was seen with WannaCryptor.
Following Microsoft’s release of these latest patches, security researchers were able to create several working proofs-of-concept, but at the time of writing, none of these have been publicly released and there are no known cases of the flaw being exploited in the wild.
The flaw, listed as CVE-2019-0708, affects multiple in-support and out-of-support versions of Microsoft’s operating systems. Users of Windows 7, Windows Server 2008 R2, and Windows Server 2008 with automatic updates enabled are protected. Microsoft also issued special updates for two non-supported versions – namely Windows XP and Windows Server 2003 – which are available via this site. Windows 8 and Windows 10 are not affected by the vulnerability.
Microsoft has not released patches for Windows Vista, despite this version also being affected by the vulnerability. The only solution here is to disable Remote Desktop Protocol (RDP) completely or only allow its use when accessed via VPN.
It is important to note that any company using misconfigured RDP over the internet is putting its users and resources at risk. Apart from vulnerabilities such as BlueKeep, attackers also try to brute force their way into company machines and internal systems.
The BlueKeep case bears a strong resemblance to the events from two years ago. On March 14th, 2017, Microsoft released fixes for a wormable vulnerability in the Server Message Block (SMB) protocol, advising all users to patch their Windows machines immediately.
The reason for this was the EternalBlue exploit – a malicious tool allegedly designed by and stolen from the National Security Agency (NSA) – which targeted the SMB loophole. A month later, EternalBlue leaked online and in a few weeks became the vehicle for the two most damaging cyberattacks in recent history – WannaCry(ptor) and NotPetya (Diskcoder.C).
A similar scenario might unfold with BlueKeep given its wormable nature. Right now, it is only a matter of time until someone publishes a working exploit, or a malware author starts selling one on the underground markets. Should that happen, it will probably become very popular among less skilled cybercriminals and a lucrative asset for its originator.
BlueKeep will also show if organizations around the world learned a lesson after the large 2017 outbreaks and improved their security posture and patching routines.
To sum it up, organisations and users are advised to:
1. Patch, patch, patch. If you or your organisation run a supported version of Windows, update it to the latest version. If possible, enable automatic updates. If you are still using unsupported Windows XP or Windows Server 2003 – for whatever reason – download and apply the patches as soon as possible.
2. Disable Remote Desktop Protocol. Despite RDP itself not being vulnerable, Microsoft advises organisation to disable it until the latest patches have been applied. Further, to minimize your attack surface, RDP should only be enabled on devices where it really is used and needed.
3. Configure RDP properly. If your organisation absolutely must use RDP, avoid exposing it to the public internet. Only devices on the LAN, or accessing via a VPN, should be able to establish a remote session. Another option is to filter RDP access using firewall, whitelisting only a specific IP range. The security of your remote sessions can be further improved by using multi-factor authentication.
4. Enable Network Level Authentication (NLA). BlueKeep can be partially mitigated by having NLA enabled, as it requires the user to authenticate before a remote session is established and the flaw can be misused. However, as Microsoft adds, “affected systems are still vulnerable to Remote Code Execution (RCE) exploitation if the attacker has valid credentials that can be used to successfully authenticate.”
5. Use a reliable multi-layered security solution that can detect and mitigate the attacks exploiting the flaw on the network level.
Lenovo unveils world’s smallest desktop PC
ThinkCentre M90n-1 Nano is powered by 8th generation Intel processors and SSD storage, catering to flexible working
Lenovo has introduced the world’s smallest desktop PC, the ThinkCentre M90n-1 Nano, to the South African Market. It says it is designed to support diverse workplaces with the power of a full-size desktop and the space-saving convenience of a laptop.
“The ThinkCentre M90n-1 Nano is further proof of Lenovo’s commitment to helping small businesses drive efficiency in their operations,” says Thibault Dousson, General Manager at Lenovo South Africa. “In South Africa, SMEs make up a third of the country’s GDP and play an integral part in boosting the economy and creating jobs. Lack of capital, investment, resources or support are among the major challenges faced by our country’s entrepreneurs.
“Lenovo wants to help entrepreneurs grow their businesses through giving them better access to critical tools and services, such as our financial services offering and leasing option. The ThinkCentre M90n-1 Nano is ideal for small business owners as it is reliable and powerful yet compact and easily transportable.”
Delivering powerful performance in an ultra-portable size, the ThinkCentre M90n-1 Nano is the most compact commercial desktop series in the world. Compact models are one-third the size of the ground-breaking ThinkCentre Tiny, at just 0.35L in volume.
With fully functional USB Type-C Gen2 and USB 3.1 Gen2 ports located on the front and back of the device, multiple displays, docks and other hardware options can further boost productivity. The ability to be powered using just one cable to a USB Type-C monitor makes the M90n-1 Nano ideal for a clutter-free workspace, whether it be placed behind a screen or under a desk.
The ThinkCentre M90n-1 Nano is MIL-810G SPEC tested – built to withstand extreme conditions including shocks, drops, dust and humidity. The desktop’s HW TPM 2.0 chip encrypts data to keep sensitive data secure, while its Kensington lock slot enables users to physically secure the device to an immovable object, protecting it from theft.
With its Modern Standby feature, users can receive emails, VoIP calls and instant messages while remaining in standby mode. When ready to commence work, the M90n-1 Nano resumes full functionality in under one second.
These features make the ThinkCentre M90n-1 Nano an easy fit across all office environments, or wherever space is limited, and staff are mobile. The ThinkCentre M90n-1 Nano also reduces energy consumption by as much as 30 percent annually over the ThinkCentre Tiny.
Powered by the 8th generation Intel processors and backed by SSD (solid state drive) storage, the ThinkCentre M90n-1 Nano offers diverse connectivity and multi-user options to keep users connected.
Hackers target hotels
Kaspersky’s research of the RevengeHotels campaign aimed at the hospitality sector, has confirmed over 20 hotels in Latin America, Europe and Asia have fallen victim to targeted malware attacks. Even more hotels are potentially affected across the globe. Travelers’ credit card data, which is stored in a hotel administration system, including those received from online travel agencies (OTAs), is at risk of being stolen and sold to criminals worldwide.
RevengeHotels is a campaign that includes different groups using traditional Remote Access Trojans (RATs) to infect businesses in the hospitality sector. The campaign has been active since 2015 but has gone on to increase its presence in 2019. At least two groups, RevengeHotels and ProCC, were identified to be part of the campaign, however more cybercriminal groups are potentially involved.
The main attack vector in this campaign is emails with crafted malicious Word, Excel or PDF documents attached. Some of them exploit CVE-2017-0199, loading it using VBS and PowerShell scripts and then installing customised versions of various RATs and other custom malware, such as ProCC, on the victim’s machine that could later execute commands and set up remote access to the infected systems.
Each spear-phishing email was crafted with special attention to detail and usually impersonating real people from legitimate organisations making a fake booking request for a large group of people. It is worth noting that even careful users could be tricked to open and download attachments from such emails as they include an abundance of details (for instance, copies of legal documents and reasons for booking at the hotel) and looked convincing. The only detail that would reveal the attacker would be a typosquatting domain of the organisation.
A phishing email sent to a hotel impersonating a booking request from an attorney’s office
Once infected, the computer could be accessed remotely not just by the cybercriminal group itself — evidence collected by Kaspersky researchers shows that remote access to hospitality desks and the data they contain is sold on criminal forums on a subscription basis. Malware collected data from hospitality desk clipboards, printer spoolers and captured screenshots (this function was triggered using specific words in English or Portuguese). Because hotel personnel often copied clients’ credit card data from OTA’s in order to charge them, that data could also be compromised.
Kaspersky telemetry confirmed targets in Argentina, Bolivia, Brazil, Chile, Costa Rica, France, Italy, Mexico, Portugal, Spain, Thailand and Turkey. However, based on data extracted from Bit.ly, a popular link shortening service used by the attackers to spread malicious links, Kaspersky researchers assume that users from many other countries have at least accessed the malicious link – suggesting that the number of countries with potential victims could be higher.
“As users grow wary of how protected their data truly is, cybercriminals turn to small businesses, which are often not very well protected from cyberattacks and possess a concentration of personal data. Hoteliers and other small businesses dealing with customer data need to be more cautious and apply professional security solutions to avoid data leaks that could potentially not only affect customers, but also damage hotel reputations as well,” comments Dmitry Bestuzhev, Head of Global Research and Analysis Team, LatAm.
To stay safe, travelers are recommended to:
- Use a virtual payment card for reservations made via OTAs, as these cards normally expire after a single charge
- When paying for a reservation or checking out at hotel desks, use a virtual wallet, such as Apple Pay or Google Pay, or a secondary credit card with a limited amount of debit available
Hotel owners and management are also advised to follow these steps to secure customer data:
- Conduct risk assessments of the existing network and implement regulations regarding how customers data is handled
- Use a reliable security solution with web protection and application control functionality, such as Kaspersky Endpoint Security for Business. Web protection helps to block access to phishing and malicious websites while application control (in white list mode) allows to make sure that no application except the white listed ones can run on hospitality desk computers.
- Introduce staff security awareness training to teach employees how to spot spear-phishing attempts and show the importance of remaining vigilant when working with incoming emails.
Read the full report, RevengeHotels: cybercrime targeting hotel desks worldwide, on Securelist.