Cloud

11/9/2017
10:30 AM
Shaun Donaldson
Shaun Donaldson
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
50%
50%

Hypervisors: Now a Tool to Protect against Security Blind Spots

By facilitating live introspection of virtual machine memory, the Xen Project is striving to eliminate stealthy attack techniques like EternalBlue.

Plenty of ink has been used to discuss WannaCry, and rightfully, since ransomware itself is a significant security challenge. What has been largely missed is that WannaCry is just one attack that took advantage of EternalBlue, and that EternalBlue itself is an example of how attackers take advantage of security blind spots.

What Is EternalBlue?
On April 14, an anonymous group known as "Shadow Brokers" released 10 exploit kits. One of these kits was called EternalBlue. The group alleged that EternalBlue was originally created by the US National Security Agency (NSA).

EternalBlue gained prominence in May 2017 through a worldwide ransomware attack targeting computers running the Microsoft Windows operating system, encrypting data and demanding ransom payments in bitcoin. Like all ransomware, WannaCry is the end result of a successful attack — malware that has executed on the targeted machine. The creators of WannaCry used the EternalBlue exploit to give WannaCry the ability to propagate itself without user interaction.

Why Is EternalBlue Important?
It is not publicly known when EternalBlue was developed. Likewise, it's difficult to know how long groups, like Shadow Brokers, had EternalBlue before publicly releasing it. If you think the NSA developed EternalBlue, then you know they didn't do it to shore up their budget by distributing cryptocurrency miners. EternalBlue could have easily been used to deliver and embed quieter malware packages — say, stealthy software designed to surreptitiously find and allow exfiltration of sensitive information.

While attacks by loud malware — malware that makes its presence known — such as WannaCry gain notoriety, the goal of the most sophisticated attackers is to achieve remote access with the greatest possible stealth. In other words, WannaCry rained on the EternalBlue stealth parade. The bad news is that it is not the first, nor will it be the last private party.

But the Vulnerability Had a Patch, Right?
History has a way of repeating itself. Conficker abused MS-08-067 in 2008. SQL Slammer arrived in 2003, abusing MS02-039. The next EternalBlue will probably exploit a vulnerability that isn't yet publicly known, or for which organizations have not had time to deploy a patch.

Hopefully, all endpoint security vendors can now detect the likes of Conficker, SQL Slammer, and WannaCry. That is a good thing, but it's not enough. Detecting the results of an attack or building detection of the signs of a specific attack after the attack is necessary but does not get to the root of the problem.

If EternalBlue Is the Root of WannaCry, What Is the Root of EternalBlue?
EternalBlue exploits the SMBv1 vulnerability by using a buffer overflow. At the root, a request is sent to the SMBv1 service; the request is crafted to take advantage of the mishandling of memory to produce an unintended result (executing code included in the crafted request on the targeted system).

The code that is executed provides the attacker control by way of administrator-level privilege ("system" on Windows machines). After a successful exploit, the remote commands are run in memory — nothing needs to be written to disk. An attacker may then upload malware to the compromised system, and exfiltrate data as he wishes.

Is There a Way out of Repeating the Past?
Attacks use the same set of tools — buffer overflows, code injection, heap spray, and so on — repeatedly, and successfully, against the stack that runs operating systems, and their workloads. However, virtualization has changed the stack.

In the olden days, an operating system ran directly against hardware. Virtualization introduced the hypervisor, which acts as an interface between the operating systems and hardware. This created the opportunity to inspect — indeed, introspect — memory at a layer below the most privileged layer within guest operating systems.

The Xen Project, building on efforts from individuals and security organizations, collaborated to create Machine Introspection, an API that has been commercialized as Citrix XenServer Direct Inspect APIs. The API facilitates live introspection of virtual machine memory at the hypervisor, eliminating the need to deploy software within virtual machines. This allows for live introspection of VM memory from outside the VM, and will help eliminate some of the stealthy attack techniques like the buffer overflow EternalBlue leverages. The API is open to all security vendors to build and expand on. More information can be found here.

What Is the Bottom Line?
Malicious code doesn't arrive on a target system by mysterious means. User interaction, such as clicking on a link or accepting the installation of nefarious software, is a straightforward method of delivering an attack. On the other hand, discovering and exploiting unknown vulnerabilities long before they are recognized and patched is far more complicated and time consuming. The first succeeds by leveraging high-volume attacks, hoping that at least one user will fall for it. The second leverages intense investment in research but, like EternalBlue, does not require user interaction.

There are myriad ways of defending against widely known, high-volume attacks (user education, email and URL sanitization, etc.). Sometimes, as with WannaCry, attacks will quickly incorporate recently revealed vulnerability exploits, such as EternalBlue.

The second type of attack — identifying and exploiting unknown vulnerabilities — cannot be absolutely defeated, but by inspecting virtual machine memory at the hypervisor, plenty of attack techniques can be taken out of the attacker playbook. This raises the cost of investment in creating successful attacks, stopping things like EternalBlue from succeeding before there was such a thing as EternalBlue. 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Shaun Donaldson is director of strategic alliances at Bitdefender Enterprise. Shaun is responsible for supporting relationships with technology alliance partners, large enterprise customers, and open-source projects. Bitdefender regularly contributes to projects, including ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.