Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/6/2017
08:01 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

WannaCry Exploit Could Infect Windows 10

The EternalBlue remote kernel exploit used in WannaCry could be used to infect unpatched Windows 10 machines with malware, researchers find.

A flaw in unpatched versions of Window 10 could leave machines vulnerable to EternalBlue, the remote kernel exploit behind the recent WannaCry ransomware attack.

WannaCry targeted a Server Message Block (SMB) critical vulnerability that Microsoft patched with MS17-010 on March 14, 2017. While WannaCry damage was mostly limited to machines running Windows 7, a different version of EternalBlue could infect Windows 10.

Researchers at RiskSense stripped the original leaked version of EternalBlue down to its essential components and deemed parts of the data unnecessary for exploitation. They found they could bypass detection rules recommended by governments and antivirus vendors, says RiskSense senior security researcher Sean Dillon.

This version of EternalBlue, an exploit initially released by Shadow Brokers earlier this year, does not use the DoublePulsar payload common among other exploits leaked by the hacker group. DoublePulsar was the main implant used in WannaCry and a key focus for defenders.

"That backdoor is unnecessary," says Dillon, noting how it's dangerous for businesses to only focus on DoublePulsar malware. "This exploit could directly load malware onto the system without needing to install the backdoor."

EternalBlue gives instant un-credentialed remote access to Windows machines without the MS17-010 patch update. While it's difficult to port EternalBlue to additional versions of Windows, it's not impossible. Unpatched Windows 10 machines are at risk, despite the fact that Microsoft's newest OS receives exploit mitigations that earlier versions don't.

The slimmed-down EternalBlue can be ported to unpatched versions of Windows 10 and deliver stealthier payloads. An advanced malware would be able to target any Windows machine, broadening the spread of an attack like WannaCry, Dillon explains.

It's worth noting WannaCry was a blatant, obvious attack, he says, and other types of malware, like banking spyware and bitcoin miners, could more easily fly under the radar.

"These can infect a network and you won't know about it until years later," he says. "It's a threat to organizations that have been targets, like governments and corporations. Attackers may try to get onto these networks and lay dormant … then steal intellectual property or cause other damage."

Dillon emphasizes the importance of updating to the latest version of Windows 10, but says patching alone won't give complete protection from this kind of threat. Businesses with SMB facing the Internet should also put up firewalls, and set up VPN access for users who need external access to the internal network.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Businesses should have a good inventory of software and devices on their networks, along with processes for identifying and deploying patches as they are released, says Craig Young, computer security researcher for Tripwire's Vulnerability and Exposures Research Team (VERT). This will become even more critical as attackers move quickly from patch to exploit.

There will always be a window of opportunity for attackers before the right patches are installed, Young notes. EternalBlue is a "very fresh vulnerability" given that most breaches that use exploits leverage flaws that have been publicly known for an average of two years or more.

"EternalBlue is a particularly reliable exploit that gives access to execute code at the very highest privilege level, so I would expect that hackers and penetration testers will get a lot of use out of it for years to come," he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10102
PUBLISHED: 2019-07-22
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: ne...
CVE-2019-10102
PUBLISHED: 2019-07-22
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
CVE-2019-10102
PUBLISHED: 2019-07-22
Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections ...
CVE-2019-9959
PUBLISHED: 2019-07-22
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
CVE-2019-4236
PUBLISHED: 2019-07-22
A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backup or archive if there are more than twelve ACL entries associated with the object in total. As a result, it could allow a local attacker to ...