{"id":6734,"date":"2020-10-13T13:25:28","date_gmt":"2020-10-13T13:25:28","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=6734"},"modified":"2021-03-10T08:59:11","modified_gmt":"2021-03-10T08:59:11","slug":"vulnerability-chaining-gives-access-us-gov-networks","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/vulnerability-chaining-gives-access-us-gov-networks\/","title":{"rendered":"A Chain You Don\u2019t Want to Pay For"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"6734\" class=\"elementor elementor-6734\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<h2>Hackers Chain VPN and Microsoft Vulnerabilities to Access US Government Networks<\/h2>\n<p>How often do you see a popup about a software update and ignore it, thinking \u201cI\u2019ll get to it later\u201d? Several United States Government organisations wish they hadn\u2019t taken that exact same approach.<\/p><p><span style=\"word-spacing: normal;\">A group of hackers&nbsp;<\/span><a href=\"https:\/\/www.zdnet.com\/article\/hacker-groups-chain-vpn-and-windows-bugs-to-attack-us-government-networks\/\" style=\"word-spacing: normal;\" target=\"_blank\" rel=\"noopener\">linked together bugs<\/a><span style=\"word-spacing: normal;\">&nbsp;in commonly used VPN and Windows products to gain access to a range of US federal, state, local, tribal, and territorial (SLTT) government networks, and some non-government networks. Included in that list are some of the biggest US actors in security &#8211; namely the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI).<\/span><\/p><p><span style=\"word-spacing: normal;\">This attack tactic is known as&nbsp;<\/span><b style=\"word-spacing: normal;\">vulnerability chaining<\/b><span style=\"word-spacing: normal;\">, whereby multiple bugs are combined together to compromise a network or application.<\/span><\/p>\n<h2>Causing maximum damage by vulnerability chaining&nbsp;<\/h2>\n<p>The hackers took advantage of a flaw in one piece of software to allow them to access the flaw of another piece of software, to create a chain of vulnerabilities which eventually let them create maximum havoc. The damage caused by vulnerability chaining is definitely more than the sum of the individual vulnerabilities on their own.<\/p><p><span style=\"word-spacing: normal;\">In this case, the hackers gained access by combining a vulnerability in the Fortinet FortiOS Secure Socket Layer (SSL) VPN (bug number&nbsp;<\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-13379\" style=\"word-spacing: normal;\" target=\"_blank\" rel=\"noopener\">CVE-2018-13379<\/a><span style=\"word-spacing: normal;\">), and the Zerologon vulnerability in Windows 10\u2019s Netlogon protocol (bug number&nbsp;<\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-1472\" style=\"word-spacing: normal;\" target=\"_blank\" rel=\"noopener\">CVE-2020-1472<\/a><span style=\"word-spacing: normal;\">).<\/span><\/p><p><span style=\"word-spacing: normal;\">Fortinet FortiOS Secure Socket Layer (SSL) VPN is an on-premise VPN server which gives secure access to enterprise networks from remote locations. Vulnerability CVE-2018-13379 was discovered in 2018, and allows attackers to upload malicious files to take over Fortinet VPN servers. Step one of vulnerability is now complete, the hackers have their initial access to their target networks.<\/span><\/p><p><span style=\"word-spacing: normal;\">Once the attackers had gained the initial access, they were then able to use Zerologon to take over their targets\u2019 internal networks.<\/span><\/p>\n<h3>How Zerologon works<\/h3>\n<p><a href=\"https:\/\/www.zdnet.com\/article\/zerologon-attack-lets-hackers-take-over-enterprise-networks\/\" target=\"_blank\" rel=\"noopener\">Zerologon<\/a>&nbsp;is the name given to bug CVE-2020-1472 in Microsoft\u2019s Netlogon software. It was one of the most severe bugs ever reported to the company, and a patch was released to close this vulnerability in August 2020.&nbsp;<\/p><p><span style=\"word-spacing: normal;\">Zerologon exploits a weak cryptographic algorithm in the Netlogon authentication process. Attackers can use it to manipulate the Netlogon authentication procedures and impersonate the identity of any computer on the domain controller, disable features in the Netlogon authentication process, and change passwords. The attack takes three seconds at most to carry out.<\/span><\/p><p><span style=\"word-spacing: normal;\">The name Zerologon comes from the way that attacks are carried out by adding zero characters in Netlogon authentication parameters.<\/span><\/p><p><span style=\"word-spacing: normal;\">One of the few limitations on Zerologon was that it couldn\u2019t take over Windows Servers from outside the network. The attackers needed a foothold into the network, and that is what they got from the Fortinet vulnerability. Once the two were combined, the attackers were able to enter their target\u2019s network, and do anything they wanted from inside the Windows domain.<\/span><\/p><p><span style=\"word-spacing: normal;\">It\u2019s worth noting here, that the joint statement from CISA and the FBI highlighted several other vulnerabilities in other commonly used software that could be used in similar vulnerability chaining attacks. These vulnerabilities include Juniper CVE-2020-1631, Pulse Secure CVE-2019-11510, Citrix NetScaler CVE-2019-19781, and Palo Alto Networks CVE-2020-2021.<\/span><\/p>\n<h2>Why did this attack take place now?<\/h2>\n<p>The joint statement from CISA and the FBI states that it doesn\u2019t appear that these targets were selected because they have access to US 2020 election information, and that to date there is no evidence that election data has been compromised.&nbsp;<\/p><p><span style=\"word-spacing: normal;\">However the CISA and FBI joint statement also didn\u2019t name the hackers. Instead they called them \u201cadvanced persistent threat (APT) actors\u201d. This terminology is usually used to suggest the actions of state sponsored hackers.<\/span><\/p><p><span style=\"word-spacing: normal;\">Either way, this attack could not have come at a worse time.<\/span><\/p>\n<h2>Vulnerability chaining from legitimate remote access tools<\/h2>\n<p>Hackers have been observed in the past using legitimate remote access tools such as Remote Desktop Protocol (RDP), and VPN to access their targets with compromised credentials.<\/p><p><a href=\"https:\/\/www.zdnet.com\/article\/microsoft-says-it-detected-active-attacks-leveraging-zerologon-vulnerability\/\" style=\"word-spacing: normal;\" target=\"_blank\" rel=\"noopener\">Microsoft have also observed Zerologon<\/a><span style=\"word-spacing: normal;\">&nbsp;attacks by Iran-linked APT Mercury, and the Russian cybercrime gang TA505. No official connection has been made between these groups and this latest attack.<\/span><\/p>\n<h2>Reducing the risk of vulnerability chaining attacks<\/h2>\n<p>On their own, the two vulnerabilities may not have seemed like something to panic over. Afterall, the FortiNet vulnerability had been around for a while, and Zerologon couldn\u2019t affect a network from the inside. But that is the first lesson to come from this incident. Don\u2019t ignore security updates when they are released, no matter how small the vulnerability may appear.<\/p><p><span style=\"word-spacing: normal;\">Patches are available for both of the particular products in this incident, and had those patches been implemented immediately, they may have saved at least some of these organisations from attack.<\/span><\/p><p><span style=\"word-spacing: normal;\">In addition, vulnerability chaining makes it crucial that you always take a holistic view of your&nbsp;<\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\" style=\"word-spacing: normal;\">network security<\/a><span style=\"word-spacing: normal;\">. While every component of your network needs to be secure in and of itself, it is also beneficial to understand how one weakness can be used to exploit another weakness and take steps to manage those interplays and improve your security posture.<\/span><\/p><p><span style=\"word-spacing: normal;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Hackers have used vulnerability chaining combining known vulnerabilities in their VPN and Windows programs to hack into US government networks<\/p>\n","protected":false},"author":4,"featured_media":6738,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/6734"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=6734"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/6734\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/6738"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=6734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=6734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=6734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}