APT group used CVE-2018-8589 Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-8453 | Win32k Elevation of Privilege Flaw in Windows 7-10 and Windows Server (CVE-2018-8453) CVE-2018-8453 is an elevation of privilege vulnerability in the Windows Win32k kernel component, which fails to properly handle objects in memory, including the Win32k user-callback path reachable via NtUserSetWindowFNID. An attacker who can already execute code on an affected machine can trigger the flaw to escalate privileges, gaining the equivalent of SYSTEM-level rights with high impact on confidentiality, integrity, and availability. All broadly deployed Windows releases of the era are affected, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 1809), and Windows Server 2008 through 2019, so any unpatched Windows desktop or server is in scope. The flaw was exploited as a zero-day by the FruityArmor APT in targeted attacks in the Middle East, disclosed and patched in Microsoft's October 2018 Patch Tuesday, and has public proof-of-concept code. It is confirmed exploited in the wild: it sits in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-21) with known ransomware use, and EPSS assigns a 70% probability of exploitation within 30 days. Do: Apply Microsoft's October 2018 (or later) cumulative security updates to all affected Windows 7/8.1/RT 8.1/Windows 10 clients and Windows Server 2008-2019 systems, per the vendor instructions required by CISA's KEV catalog. Prioritize multi-user hosts such as terminal/RDS servers and workstations where users can run untrusted code, since the attack requires local code execution with user interaction. Systems still on Windows 7/8.1 or Server 2008/2008 R2/2012 should be moved to Extended Security Updates or upgraded, and defenders should hunt for signs of FruityArmor-style activity on long-lived unpatched hosts. | 7.8 | 70% | KEV ransomware PoC ×2 |
| masshundreds of millions to ~1 billion+ Windows installations (Windows 10 alone ran on roughly 700 million active devices in 2018) | |
| CVE-2018-8589 | Local Privilege Escalation in Microsoft Windows Win32k (Windows 7 / Server 2008) CVE-2018-8589 is an elevation of privilege vulnerability in Win32k.sys, the Windows kernel-mode component that handles system calls, affecting Windows 7, Windows Server 2008, and Windows Server 2008 R2. It is triggered when Windows improperly handles calls to Win32k.sys, allowing a local attacker who is already able to execute low-privileged code (for example, via a malicious application or as a second stage of a browser exploit) to escalate privileges. A successful exploit grants the attacker elevated (kernel/SYSTEM-level) privileges on the local machine, typically enabling full control and often chained with code-execution bugs. Windows 7 and Windows Server 2008/2008 R2 users and administrators are affected; the flaw was patched in Microsoft's November 2018 security updates. The vulnerability was known to be actively exploited in the wild at the time of the November 2018 Patch Tuesday, and it is listed in CISA's Known Exploited Vulnerabilities catalog (added May 23, 2022), with EPSS at roughly 3% (87th percentile). Do: Apply the Microsoft November 2018 security updates (or later) to all Windows 7, Windows Server 2008, and Windows Server 2008 R2 systems, per the CISA KEV required action. Because Windows 7 and Server 2008 are past end of support, verify patch status on legacy/extended-support (ESU) systems, inventory any remaining unpatched hosts, and prioritize upgrading them; until patched, limit execution of untrusted local code and keep kernel exploit mitigations enabled. | 7.8 | 3% | KEV |
| masshundreds of millions of Windows 7 devices worldwide at disclosure, plus widespread Windows Server 2008/2008 R2 deployments |
Full article406 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 14, 2018
Kaspersky revealed that the CVE-2018-8589 Windows 0-day fixed by Microsoft Nov. 2018 Patch Tuesday has been exploited by at least one APT group in attacks in the Middle East.
Kaspersky Lab experts revealed that the CVE-2018-8589 Windows zero-day vulnerability addressed by Microsoft November 2018 Patch Tuesday has been exploited by an APT group in targeted attacks against entities in the Middle East.
Kaspersky reported the flaw to Microsoft on October 17, the security firm observed attacks against systems protected by its solution and attempting to exploit the zero-day flaw affecting the Win32k component in Windows.
The flaw could be exploited by an authenticated attacker to execute arbitrary code in the context of the local user, it ties the way Windows handles calls to Win32k.sys.
Kaspersky Lab described the CVE-2018-8589 flaw as a race condition in win32k!xxxMoveWindow that is caused by the improper locking of messages sent synchronously between threads.
The CVE-2018-8589 vulnerability only affects Windows 7 and Windows Server 2008.
Attackers exploited the flaw as the first stage of a malware installer aimed at a limited number of entities in the Middle East.
At the time of writing it is not unclear how the malware had been delivered by the threat actors.
“The exploit was executed by the first stage of a malware installer in order to gain the necessary privileges for persistence on the victim’s system. So far, we have detected a very limited number of attacks using this vulnerability. The victims are located in the Middle East.” reads the analysis published by Kaspersky.
Kaspersky did not explicitly attribute the attack to a specific threat actor but pointed out that the CVE-2018-8589 exploit code is being used by at least one cyber espionage APT group.
In October, Kaspersky also reported to Microsoft the CVE-2018-8453 flaw that had been exploited by the threat group known as FruityArmor in a highly targeted campaign.
the FruityArmor APT group is active at least since 2016 when targeted activists, researchers, and individuals related to government organizations.
In October, the cyber espionage group exploited a Windows zero-day flaw in attacks aimed at entities in the Middle East.
Researchers pointed out that both issues affect the Win32k component and both flaws were used in attacks aimed at users in the Middle East, but Kaspersky did not link the two attacks.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – CVE-2018-8589, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/78019/apt/cve-2018-8589-middle-east-attacks.html