Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

7/30/2019
12:00 PM
50%
50%

BlueKeep Exploits Appear as Security Firms Continue to Worry About Cyberattack

The lack of an attack has puzzled some security experts, but the general advice remains that companies should patch their vulnerable systems more quickly.

When Microsoft originally issued an alert for a remotely exploitable software flaw in mid-May, security firms immediately drew analogies between the danger posed by the so-called "BlueKeep" vulnerability and the destruction caused by the ETERNAL BLUE exploit, reportedly stolen from the National Security Agency and used to enable the pernicious WannaCry worm to spread in 2017.

Within a week, companies reported they had created successful exploits for the flaw. Researchers from McAfee, for example, analyzed the patch and created a proof-of-concept that could launch an app on the computer. In early July, Sophos showed off an exploit that compromises systems using a fileless attack.

However, the massive cyberattack forecasted by security firms — and worried over by Microsoft, the US Department of Homeland Security, and others — failed to materialize. The lack of a public exploit is a major reason, as is the difficulty of writing one from scratch, says David Aitel, chief security technical officer at Cyxtera, which last week announced it had incorporated a complete exploit for the BlueKeep vulnerability into its penetration-testing product, Canvas. 

"It is not trivial," he says.

Eleven weeks after Microsoft announced it had patched the critical software issues, the lack of an exploit for BlueKeep continues to puzzle some security professionals. BlueKeep (CVE-2019-0708), a vulnerability in the way older versions of Windows handle remote desktop protocol (RDP) messages, can allow an attacker to run code on systems with the service accessible from the Internet.

Yet, while a catastrophic worm is the obvious threat, other, more subtle dangers exist as well, says Dan Dahlberg, director of security research at BitSight.

"You think of the activities of the sorts of people trying to take advantage of this vulnerability for nefarious pourposes — there are people who are less experienced, who would likely turn it into a worm," he says. "But there are other actors who might utilize this vulnerability in a much more stealthy manner, and that is going to be much harder to detect."

In early July, BitSight found that some 800,000 computers still exhibited external signs of vulnerability to BlueKeep. About 5,000 systems are patched daily, Dahlberg says. 

Dahlberg and other security experts have urged companies to continue patching. Microsoft issued updates for a variety of its platforms — not only in Windows 7 and Windows Server 2008, the core systems affected by the issue, but also Windows XP and Windows 2000, both of which the company has stopped otherwise supporting.

Microsoft also has published two blog posts recommending that customers apply the updates as soon as possible. 

"It is possible that we won't see this vulnerability incorporated into malware," the company said. "But that's not the way to bet."

Typically, attacks skyrocket after a public exploit. In 2012, Symantec researched analyzed malware for the use of previously unknown exploits, so-called "zero days." The company found out of 18 exploits used in malware, 11 had not been known at the time the malware initially infected systems. Yet, once the exploits became public, use of the attacks jumped by a factor of 100,000 in some cases. 

The lack of a public exploit may explain why there has been no catastrophic attack, because those groups that have exploits — security companies and government intelligence organizations — will use them only for a focused purpose. The WannaCry worm, attributed to North Korea, occurred only after the exploit had been publicly released.

"The reason that we have not seen a big malicious worm like WannaCry, that may have more to do with geopolitics and the state of US-Russia relations than anything else," Cyxtera's Aitel says.

In the past, security firms that have created exploits have faced criticism, yet the security community has recognized the legitimacy of researching potential attacks by creating exploits. The addition of exploit code into Cyxtera's Canvas has caused much less consternation than in the past. 

"Our objective is to help customers solve their risk problems," Cyxtera said in a statement. "It's not just about BlueKeep — there will always be another vulnerability that comes along and puts you at risk."

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

 

 

 

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4483
PUBLISHED: 2019-08-20
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X...
CVE-2019-4484
PUBLISHED: 2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164068.
CVE-2019-4485
PUBLISHED: 2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164069.
CVE-2019-7593
PUBLISHED: 2019-08-20
Metasys? ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
CVE-2019-7594
PUBLISHED: 2019-08-20
Metasys? ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).