Cloud

11/9/2017
10:30 AM
Shaun Donaldson
Shaun Donaldson
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
50%
50%

Hypervisors: Now a Tool to Protect against Security Blind Spots

By facilitating live introspection of virtual machine memory, the Xen Project is striving to eliminate stealthy attack techniques like EternalBlue.

Plenty of ink has been used to discuss WannaCry, and rightfully, since ransomware itself is a significant security challenge. What has been largely missed is that WannaCry is just one attack that took advantage of EternalBlue, and that EternalBlue itself is an example of how attackers take advantage of security blind spots.

What Is EternalBlue?
On April 14, an anonymous group known as "Shadow Brokers" released 10 exploit kits. One of these kits was called EternalBlue. The group alleged that EternalBlue was originally created by the US National Security Agency (NSA).

EternalBlue gained prominence in May 2017 through a worldwide ransomware attack targeting computers running the Microsoft Windows operating system, encrypting data and demanding ransom payments in bitcoin. Like all ransomware, WannaCry is the end result of a successful attack — malware that has executed on the targeted machine. The creators of WannaCry used the EternalBlue exploit to give WannaCry the ability to propagate itself without user interaction.

Why Is EternalBlue Important?
It is not publicly known when EternalBlue was developed. Likewise, it's difficult to know how long groups, like Shadow Brokers, had EternalBlue before publicly releasing it. If you think the NSA developed EternalBlue, then you know they didn't do it to shore up their budget by distributing cryptocurrency miners. EternalBlue could have easily been used to deliver and embed quieter malware packages — say, stealthy software designed to surreptitiously find and allow exfiltration of sensitive information.

While attacks by loud malware — malware that makes its presence known — such as WannaCry gain notoriety, the goal of the most sophisticated attackers is to achieve remote access with the greatest possible stealth. In other words, WannaCry rained on the EternalBlue stealth parade. The bad news is that it is not the first, nor will it be the last private party.

But the Vulnerability Had a Patch, Right?
History has a way of repeating itself. Conficker abused MS-08-067 in 2008. SQL Slammer arrived in 2003, abusing MS02-039. The next EternalBlue will probably exploit a vulnerability that isn't yet publicly known, or for which organizations have not had time to deploy a patch.

Hopefully, all endpoint security vendors can now detect the likes of Conficker, SQL Slammer, and WannaCry. That is a good thing, but it's not enough. Detecting the results of an attack or building detection of the signs of a specific attack after the attack is necessary but does not get to the root of the problem.

If EternalBlue Is the Root of WannaCry, What Is the Root of EternalBlue?
EternalBlue exploits the SMBv1 vulnerability by using a buffer overflow. At the root, a request is sent to the SMBv1 service; the request is crafted to take advantage of the mishandling of memory to produce an unintended result (executing code included in the crafted request on the targeted system).

The code that is executed provides the attacker control by way of administrator-level privilege ("system" on Windows machines). After a successful exploit, the remote commands are run in memory — nothing needs to be written to disk. An attacker may then upload malware to the compromised system, and exfiltrate data as he wishes.

Is There a Way out of Repeating the Past?
Attacks use the same set of tools — buffer overflows, code injection, heap spray, and so on — repeatedly, and successfully, against the stack that runs operating systems, and their workloads. However, virtualization has changed the stack.

In the olden days, an operating system ran directly against hardware. Virtualization introduced the hypervisor, which acts as an interface between the operating systems and hardware. This created the opportunity to inspect — indeed, introspect — memory at a layer below the most privileged layer within guest operating systems.

The Xen Project, building on efforts from individuals and security organizations, collaborated to create Machine Introspection, an API that has been commercialized as Citrix XenServer Direct Inspect APIs. The API facilitates live introspection of virtual machine memory at the hypervisor, eliminating the need to deploy software within virtual machines. This allows for live introspection of VM memory from outside the VM, and will help eliminate some of the stealthy attack techniques like the buffer overflow EternalBlue leverages. The API is open to all security vendors to build and expand on. More information can be found here.

What Is the Bottom Line?
Malicious code doesn't arrive on a target system by mysterious means. User interaction, such as clicking on a link or accepting the installation of nefarious software, is a straightforward method of delivering an attack. On the other hand, discovering and exploiting unknown vulnerabilities long before they are recognized and patched is far more complicated and time consuming. The first succeeds by leveraging high-volume attacks, hoping that at least one user will fall for it. The second leverages intense investment in research but, like EternalBlue, does not require user interaction.

There are myriad ways of defending against widely known, high-volume attacks (user education, email and URL sanitization, etc.). Sometimes, as with WannaCry, attacks will quickly incorporate recently revealed vulnerability exploits, such as EternalBlue.

The second type of attack — identifying and exploiting unknown vulnerabilities — cannot be absolutely defeated, but by inspecting virtual machine memory at the hypervisor, plenty of attack techniques can be taken out of the attacker playbook. This raises the cost of investment in creating successful attacks, stopping things like EternalBlue from succeeding before there was such a thing as EternalBlue. 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Shaun Donaldson is director of strategic alliances at Bitdefender Enterprise. Shaun is responsible for supporting relationships with technology alliance partners, large enterprise customers, and open-source projects. Bitdefender regularly contributes to projects, including ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I'm not sure I like this top down management approach!"
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17321
PUBLISHED: 2018-09-22
An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action.
CVE-2018-17322
PUBLISHED: 2018-09-22
Cross-site scripting (XSS) vulnerability in index.php/index/category/index in YUNUCMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the area parameter.
CVE-2018-14889
PUBLISHED: 2018-09-21
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.
CVE-2018-14890
PUBLISHED: 2018-09-21
Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Management Console.
CVE-2018-14891
PUBLISHED: 2018-09-21
Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnerability.