Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

11/9/2017
10:30 AM
Shaun Donaldson
Shaun Donaldson
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Hypervisors: Now a Tool to Protect against Security Blind Spots

By facilitating live introspection of virtual machine memory, the Xen Project is striving to eliminate stealthy attack techniques like EternalBlue.

Plenty of ink has been used to discuss WannaCry, and rightfully, since ransomware itself is a significant security challenge. What has been largely missed is that WannaCry is just one attack that took advantage of EternalBlue, and that EternalBlue itself is an example of how attackers take advantage of security blind spots.

What Is EternalBlue?
On April 14, an anonymous group known as "Shadow Brokers" released 10 exploit kits. One of these kits was called EternalBlue. The group alleged that EternalBlue was originally created by the US National Security Agency (NSA).

EternalBlue gained prominence in May 2017 through a worldwide ransomware attack targeting computers running the Microsoft Windows operating system, encrypting data and demanding ransom payments in bitcoin. Like all ransomware, WannaCry is the end result of a successful attack — malware that has executed on the targeted machine. The creators of WannaCry used the EternalBlue exploit to give WannaCry the ability to propagate itself without user interaction.

Why Is EternalBlue Important?
It is not publicly known when EternalBlue was developed. Likewise, it's difficult to know how long groups, like Shadow Brokers, had EternalBlue before publicly releasing it. If you think the NSA developed EternalBlue, then you know they didn't do it to shore up their budget by distributing cryptocurrency miners. EternalBlue could have easily been used to deliver and embed quieter malware packages — say, stealthy software designed to surreptitiously find and allow exfiltration of sensitive information.

While attacks by loud malware — malware that makes its presence known — such as WannaCry gain notoriety, the goal of the most sophisticated attackers is to achieve remote access with the greatest possible stealth. In other words, WannaCry rained on the EternalBlue stealth parade. The bad news is that it is not the first, nor will it be the last private party.

But the Vulnerability Had a Patch, Right?
History has a way of repeating itself. Conficker abused MS-08-067 in 2008. SQL Slammer arrived in 2003, abusing MS02-039. The next EternalBlue will probably exploit a vulnerability that isn't yet publicly known, or for which organizations have not had time to deploy a patch.

Hopefully, all endpoint security vendors can now detect the likes of Conficker, SQL Slammer, and WannaCry. That is a good thing, but it's not enough. Detecting the results of an attack or building detection of the signs of a specific attack after the attack is necessary but does not get to the root of the problem.

If EternalBlue Is the Root of WannaCry, What Is the Root of EternalBlue?
EternalBlue exploits the SMBv1 vulnerability by using a buffer overflow. At the root, a request is sent to the SMBv1 service; the request is crafted to take advantage of the mishandling of memory to produce an unintended result (executing code included in the crafted request on the targeted system).

The code that is executed provides the attacker control by way of administrator-level privilege ("system" on Windows machines). After a successful exploit, the remote commands are run in memory — nothing needs to be written to disk. An attacker may then upload malware to the compromised system, and exfiltrate data as he wishes.

Is There a Way out of Repeating the Past?
Attacks use the same set of tools — buffer overflows, code injection, heap spray, and so on — repeatedly, and successfully, against the stack that runs operating systems, and their workloads. However, virtualization has changed the stack.

In the olden days, an operating system ran directly against hardware. Virtualization introduced the hypervisor, which acts as an interface between the operating systems and hardware. This created the opportunity to inspect — indeed, introspect — memory at a layer below the most privileged layer within guest operating systems.

The Xen Project, building on efforts from individuals and security organizations, collaborated to create Machine Introspection, an API that has been commercialized as Citrix XenServer Direct Inspect APIs. The API facilitates live introspection of virtual machine memory at the hypervisor, eliminating the need to deploy software within virtual machines. This allows for live introspection of VM memory from outside the VM, and will help eliminate some of the stealthy attack techniques like the buffer overflow EternalBlue leverages. The API is open to all security vendors to build and expand on. More information can be found here.

What Is the Bottom Line?
Malicious code doesn't arrive on a target system by mysterious means. User interaction, such as clicking on a link or accepting the installation of nefarious software, is a straightforward method of delivering an attack. On the other hand, discovering and exploiting unknown vulnerabilities long before they are recognized and patched is far more complicated and time consuming. The first succeeds by leveraging high-volume attacks, hoping that at least one user will fall for it. The second leverages intense investment in research but, like EternalBlue, does not require user interaction.

There are myriad ways of defending against widely known, high-volume attacks (user education, email and URL sanitization, etc.). Sometimes, as with WannaCry, attacks will quickly incorporate recently revealed vulnerability exploits, such as EternalBlue.

The second type of attack — identifying and exploiting unknown vulnerabilities — cannot be absolutely defeated, but by inspecting virtual machine memory at the hypervisor, plenty of attack techniques can be taken out of the attacker playbook. This raises the cost of investment in creating successful attacks, stopping things like EternalBlue from succeeding before there was such a thing as EternalBlue. 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Shaun Donaldson is director of strategic alliances at Bitdefender Enterprise. Shaun is responsible for supporting relationships with technology alliance partners, large enterprise customers, and open-source projects. Bitdefender regularly contributes to projects, including ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8142
PUBLISHED: 2020-04-03
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was how...
CVE-2020-8143
PUBLISHED: 2020-04-03
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/...
CVE-2020-8147
PUBLISHED: 2020-04-03
Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.
CVE-2020-6994
PUBLISHED: 2020-04-03
A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The followi...
CVE-2020-8637
PUBLISHED: 2020-04-03
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.