Prioritize patching vulnerabilities associated with ransomware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0601 | ECC Certificate Spoofing in Microsoft Windows CryptoAPI (Crypt32.dll) CVE-2020-0601 (known as 'Curveball') is a spoofing flaw in Crypt32.dll, the Windows CryptoAPI component that validates Elliptic Curve Cryptography (ECC) certificates, which mishandles ECC certificate parameters when checking signatures. An attacker can trigger it by signing malicious content, most notably an executable, with a spoofed, attacker-controlled ECC certificate that Windows accepts as if it were issued by a trusted certificate authority; the attack vector is network-based but requires user interaction (CVSS 3.1: 8.1, AV:N/AC:L/PR:N/UI:R). Successful exploitation makes attacker-supplied malware appear to come from a legitimate, trusted software vendor, defeating code-signing trust prompts and signature-based trust decisions, with high impact on confidentiality and integrity. Affected systems are the Microsoft Windows 10 builds 1507 through 1909 and Windows Server versions 1803, 1903, 1909, 2016 and 2019 in the CISA data, with Go also listed as an affected vendor via its ECC certificate validation, effectively covering the mainstream Windows install base at the time. The flaw was discovered by the NSA and patched in the January 2020 Patch Tuesday; it is now CISA KEV-listed (added 2021-11-03, ransomware use unknown) with very high predicted exploitation risk (EPSS 89.4%, 100th percentile), and no public PoC is tracked in this data. Do: Apply Microsoft's January 2020 Patch Tuesday cumulative security updates for all affected Windows 10 and Windows Server builds, per CISA's required action (apply updates per vendor instructions). Prioritize user workstations and servers that validate signed binaries, Authenticode signatures, or TLS certificates, since exploitation hinges on a user or application trusting a spoofed ECC-signed artifact. If Go is deployed in your environment, update Go toolchains to a patched January 2020 or later release, as Go was also acknowledged as an affected vendor. | 8.1 | 89% | KEV |
| massover 1 billion Windows devices (essentially the entire Windows 10 install base on builds 1507-1909, plus Windows Server 2016/2019 deployments) | |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%. Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt… | 8.8 | 100% | KEV ransomware PoC ×3 |
| masshundreds of millions of Windows systems (order of magnitude 10^8) |
Full article672 words · extracted from helpnetsecurity.com · click to collapse
A threat research from Cyber Security Works (CSW) has revealed a 7.6% increase in ransomware vulnerabilities since the publication of the Ransomware Spotlight Report in January 2022.
In the last quarter, ransomware attacks have made mainstream headlines on a near-daily basis, with groups like Lapsus$ and Conti’s names splashed across the page. Major organizations like Okta, Globant and Kitchenware maker Meyer Corporation have all fallen victim, and they are very much not alone. The data indicates that increasing vulnerabilities, new advanced persistent threat (APT) groups and new ransomware families are contributing to ransomware’s continued prevalence and profitability.
The top stats
- 22 new vulnerabilities and nine new weaknesses have been associated with ransomware since January 2022; of the 22, a whopping 21 are considered of critical or high risk severity
- 19 (out of 22) of the newly-added vulnerabilities are associated with the Conti ransomware gang
- Three new APT groups (Exotic Lily, APT 35, DEV-0401) and four new ransomware families (AvosLocker, Karma, BlackCat, Night Sky) are deploying ransomware to attack their targets
- 141 of CISA’s Known Exploited Vulnerabilities (KEVs) are being used by ransomware operators – including 18 newly identified this quarter
- 11 vulnerabilities tied to ransomware remain undetected by popular scanners
- 624 unique vulnerabilities were found within the 846 healthcare products analyzed
The details
Increase in ransomware vulnerabilities
The 7.6% increase in vulnerabilities brings the total number to 310, highlighting the fact that ransomware operators are relentlessly going after weaknesses that could be quickly weaponized.
Researchers also noticed a 6.8% increase in vulnerabilities trending in the deep and dark web and hacker channels, proving the significance of these vulnerabilities in future ransomware attacks. A threat intelligence research also predicts a high possibility of exploitation for 19 vulnerabilities, of which 14 were warned as having high threat chatter more than 10 months prior to the time of publishing this report.
Increase in APT groups using ransomware
The Q1 research uncovered that three new APT groups, Exotic Lily, APT 35 and DEV-0401, have started using ransomware to mount attacks on their targets, increasing the overall number of global APT groups from 40 to 43. These groups have long been known to use espionage and are major players in the Russia-Ukraine cyberwar and conflict. With Conti ransomware operators openly pledging their support to the Russian government, it was not surprising that Conti added 27 new vulnerabilities to its arsenal in Q1 2022.
“Today, on average, vulnerabilities are being weaponized within eight days of being published by the vendor. Latencies are dangerous windows of opportunities that are afforded to the attackers, and they spare no time in exploiting them,” said Aaron Sandeen, CEO, CSW.
“We also noticed that attackers are going after specific types of weaknesses (CWEs) associated with key products. Organizations will need to utilize attack surface management and perform additional application scanning to understand and prioritize vulnerabilities associated with ransomware.”
Scanners still aren’t detecting 3.5% of all vulnerabilities
The report reveals that from the previous quarter, there has been a decrease in the number of undetected vulnerabilities – from 22 to 11. These 11 vulnerabilities are associated with ransomware groups such as Ryuk, Petya and Locky.
Healthcare must be on high alert
Additionally, researchers analyzed 846 products used in the healthcare sector and investigated 624 unique vulnerabilities that exist in them. Forty of them have public exploits available, while two vulnerabilities, CVE-2020-0601 and CVE-2021-34527, in Biomerieux Operating System and Stryker’s ADAPT, NAV3i, NAV3 surgical navigation platforms, Scopis ENUs, respectively, are being exploited by four ransomware operators – BigBossHorse, Cerber, Conti, and Vice Society.
Anuj Goel, CEO of Cyware, concluded, “One of the major concerns that has surfaced from this research is the lack of complete threat visibility for security teams due to cluttered threat intelligence available across sources. If security teams have to mitigate ransomware attacks proactively, they must tie their patch and vulnerability response to a centralized threat intelligence management workflow that drives complete visibility into the shape-shifting ransomware attack vectors through multi-source intelligence ingestion, correlation and security actioning.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/05/19/increase-ransomware-vulnerabilities/