10 ms·

Windows Server vulnerability requires immediate attention

425 points by ohjeez 6y ago

collsni 6y ago
This is from a month ago, if you patched your DCs in August you are good.
dfv 6y ago
Microsoft really can't catch a fucking break this year, can they?
- chromedev 6y ago
  Poor Microsoft. They are so ethical. /s
- giancarlostoro 6y ago
  Their stock has done mighty fine. Before anyone says if its down now check how much its gone through YTD. I still feel like their stocks highly undervalued considering where their competitors stock is at.
- dylan604 6y ago
  It's 2020 for Microsoft just like it is for the rest of us.
MattGaiser 6y ago
> We have directed agencies to implement the patch across their infrastructure by Monday, September 21 Actually, they have until Monday.
acqq 6y ago
It I see it correctly, it's about "August 2020 security update" which was published 11 Aug 2020, more than a month ago.
- MrMorden 6y ago
  Correct. And "government-grade security" isn't a compliment. CISA definitely has some people who want to do the right thing, but they need budgetary control over other agencies to make it happen. (Speaking as someone who worked for the federal government for 15+ years, the most effective means of persuasion would be travel and reserved parking enforcement for Senior Executive Service members.) CISA also doesn't have authority over DoD or IC systems, let alone the aforementioned budgetary authority to make them do it. No, it doesn't make any sense to apply a lesser standard to systems that are more sensitive. Like I said, government-grade security.
  - tialaramex 6y ago
    The financial sector is also terrible. During SHA-1 deprecation for example, almost all the trouble was with the financial sector. The way the bogus issuance that led to discovering problem at StartCom / WoSign was detected begins with a financial services company that is desperately trying to get a SHA-1 certificate issued after it's too late and finds WoSign will back date the certificate for some undisclosed amount of money. Even some of the Symantec / Crosscert stuff comes back to the Korean banking and financial sector, (in the district south of the river in Seoul which we'd anglicize "Gangnam" yes that Gangnam...). And lots of "We must have RSA kex" was the financial sector too. You've probably got a chip card as credit card or debit card, but even though that chip is relatively a technological heavyweight (compared to things like your employee badge that authorises access to the shared office printer, or a public transit card) the crypto in it is... not so hot, and the surrounding infrastructure built by financial companies is awful. And the chip card doesn't actually secure the thing you care about - your money - it only secures the thing the issuer cares about, tying your transaction to you. Actual financial transfers are done entirely on a trust basis like it's still the 19th century, the card just presents authorization which is optional.
    - vjt 6y ago
      what I find most frustrating is that finance institution buy extremely overpriced and brittle software from renowned vendors not because of technical excellence but for risk management: they want a supplier to blame when something goes wrong. the problem with this is that nowadays suppliers are stronger in defending themselves from such blames than they are in writing good software. furthermore, the software being sold is very pricey and the cost of customising it often exceeds the cost of the software itself. then, 9 times out of 10 the issues lie in the customisations, and that doesn’t surprise, as the institution will be using most the custom parts as those are the ones they need most. here the vendors have even more grip in demonstrating that it’s the customer requirements’ fault, and not their crappy software, that confuses the concepts of “database” and “application server”. I try to counter this by writing solid, robust software using open source components, giving back when possible, perfectly filling the company’s requirements, well integrated and reasonably cheap to maintain. slowly, this can help in abandoning vendors and building in-house know-how. I find this crucial because the quality of software sold by some vendors is very very low, and getting worse.
ComodoHacker 6y ago
Microsoft Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472
waihtis 6y ago
Exploits for this have been floating on Github for at least a week already. The vulnerability game has become pretty fast paced nowerdays..
GEBBL 6y ago
They are slow off the mark here
gjsman-1000 6y ago
I've used Linux so much, I initially read the title as "Window (singular) Server Vulnerability...", leading me to wonder what was wrong with Xorg this time...
- sk5t 6y ago
  Isn't Xorg technically the Xwindows client?
  - racingmars 6y ago
    No, Xorg (or at least the component of Xorg I think you're thinking about) is the server -- specifically, the display server. Clients -- the individual applications you run -- connect to the display server to draw themselves. (so, e.g., xeyes, xlogo, Firefox, etc. are the clients).
  - hackbinary 6y ago
    Technically it is the X Window System. :) https://en.m.wikipedia.org/wiki/X_Window_System https://en.m.wikipedia.org/wiki/X_Window_System
  - jacquesm 6y ago
    A certain Don Hopkins has written about this: "We have tried to avoid paragraph-length footnotes in this book, but X has defeated us by switching the meaning of client and server. In all other client/server relationships, the server is the remote machine that runs the application (i.e., the server provides services, such as database service or computational service). For some perverse reason that's better left to the imagination, X insists on calling the program running on the remote machine "the client." " From: http://www.art.net/~hopkins/Don/unix-haters/x-windows/disaster.html http://www.art.net/~hopkins/Don/unix-haters/x-windows/disast...
    - marcosdumay 6y ago
      Things are complicated when the remote computer calls your desktop. But that's how X works. That's also why once in a while somebody discover a completely unexpected vulnerability on it that, although simple nobody thought about it before. Things are so non-intuitive that it's hard even to talk about them. Yet, somehow it works. And works quite well. I imagine the authors of that book are quite annoyed by how Unix evolve to work really well, and still avoided fixing any fundamental problem.
cpach 6y ago
There was a patch released last Tuesday, wasn’t it? Not so fun though for those who still are on Server 2008 though. (Yes, that is still a thing unfortunately.)
- PakG1 6y ago
  I'm trying to get off! It's not easy! These apps won't run on a later version of Windows Server, they're too old! Tell my boss to give me more budget to get things done properly! :(
  - vaccinator 6y ago
    > Tell my boss to give me more budget to get things done properly How much would someone get for getting this done?
    - chucky_z 6y ago
      Usually $0. I've been in this situation. Getting a $1000 budget approval took months and was _tough_.
    - PakG1 6y ago
      Getting the app upgraded or changed to not need 2008 is the hard part. If the app could run on a later version of Windows, this would be really easy. I'm sure you can appreciate how difficult that might be. For custom apps, it could be a lot of code to update. For vendor apps, that app would also probably need to be upgraded to a newer version because the app is also end of life for some years now. In our case, it's a vendor app. No time and money to fix this situation, so we just keep it running and pray.
  - slaymaker1907 6y ago
    Why would that affect what the DC server is? Usually those are run as dedicated servers.
    - PakG1 6y ago
KindOne 6y ago
This has been posted on /r/sysadmin on Reddit: https://www.reddit.com/r/sysadmin/comments/i7yh5d/cve20201472_netlogon_elevation_of_privilege/ https://www.reddit.com/r/sysadmin/comments/i7yh5d/cve2020147... Twitter post explaining it: https://twitter.com/RyanLNewington/status/1293444151644626944 https://twitter.com/RyanLNewington/status/129344415164462694... Blog post explaining it: https://www.tenable.com/blog/cve-2020-1472-zerologon-vulnerability-in-netlogon-could-allow-attackers-to-hijack-windows https://www.tenable.com/blog/cve-2020-1472-zerologon-vulnera... POC: https://infinitelogins.com/2020/09/15/abusing-cve-2020-1472-zerologon/ https://infinitelogins.com/2020/09/15/abusing-cve-2020-1472-...
- AlphaMaelstrom 6y ago
  I missed this on reddit though, so more coverage is a good thing. Need to make sure all our managed servers aren't behind on any updates first thing monday.
- WalterSobchak 6y ago
  Whitepaper for CVE-2020-1472: https://www.secura.com/pathtoimg.php?id=2055 https://www.secura.com/pathtoimg.php?id=2055 [PDF]
- javajosh 6y ago
  "Microsoft provided patches for CVE-2020-1472 in August"
galacticaactual 6y ago
Script to test vulnerable domain controllers here: https://github.com/SecuraBV/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472
kregasaurusrex 6y ago
Here's the description for CVE-2020-1472: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
- tialaramex 6y ago
  This is an amazing bug. So what happens is, you're supposed to fill out a bunch of bytes as proof of who you are, and then a bunch of bytes that represent stuff like seconds since the start of the Unix epoch. If you can't do this, NetLogon figures you aren't really who you say you are. And the exploit is: Fill everything out with all zeroes. This will succeed one time in 256 on average. The reason why is complicated and somewhat interesting, but this stupidest possible exploit is what you get at the end of that complicated rationale. I've written previously on HN that it stands out how terrible Microsoft is at cryptographic design. If there's an opportunity to roll your own and do it badly, in a Microsoft product that's what you should expect. Google has good people (it doesn't always use them, but most often it does) for this stuff, and Apple most often seems to accept that it doesn't have good people so it'll not roll its own but just use things that already exist; but Microsoft does this over and over. In this particular case they took AES (seems fine) and an inappropriate but in principle secure cipher mode (CFB8) and then they... fixed the IV as all zeroes even though the definition of CFB is clear that you need to use a random IV.
  - ziml77 6y ago
    > Apple most often seems to accept that it doesn't have good people so it'll not roll its own but just use things that already exist Do they? Wasn't "goto fail" a bug in their SSL code? That one wasn't even a bug that a reviewer would need to reason about the logic of the code to see.
    - tialaramex 6y ago
jimrandomh 6y ago
This refers to a vulnerability that was patched in August; any systems that are still unpatched are over a month behind. In general, most security patches (for any software that's in use) are urgent; once a patch is out, some adversaries are going to reverse-engineer the patch to find out what the bug was, and mass-exploit targets that haven't patched. Any server which is that far out of date on its patches is either in need of a sysadmin, or has a sysadmin who's being negligent. There is no excuse.
- acdha 6y ago
  You’re missing the biggest reason this is relevant: enterprise IT shops with strict change management processes amd, especially in government, years of austerity budgets cutting resources for both sysadmins and rigorous testing. Either of the targets you mentioned are more the symptom than the root cause: management setting up bad incentives. If you have a charge management process which takes a month to approve updates, the problem is not the sysadmin. If years of skimping means that the operators are afraid to patch because they’ll be punished if it breaks things and they don’t have a robust testing process, the problem is not the sysadmin.
  - taf2 6y ago
    I feel these organizations that have a process that prevents critical fixes have a broken process... you either have to be ok with having your servers compromised eg data stolen or leaking user data or you have to be ok accepting that sometimes the engineer fixing a bug, adding a new feature might mess something up. I am inclined to believe a bit more to the side of move fast break things is bette than move so slow you get pwned... but sort of a delicate balancing act...
    - TheAdamAndChe 6y ago
      I studied IT security quite a lot, and implement Windows patches for dozens of companies. While you are technically right, Microsoft releases broken patches _constantly_. If we pushed out every single patch the moment they were released, we would constantly be down and fighting fires. Most small and mid-sized companies don't have hacking campaigns run against them most times. Given this, it just doesn't make sense to push out every single patch immediately. Microsoft's patches are a whole lot more stable when they're a couple months old.
vic_acid 6y ago
Well no, it required immediate attention over a month ago. Who are these incompetents not patching their servers for months on end?!
Snowbirth 6y ago
1472 patched here too https://blog.0patch.com/ https://blog.0patch.com/ https://0patch.com/ https://0patch.com/ Great for old systems where updating breaks stuff
jra_samba 6y ago
As this is a protocol level vulnerability, older versions of Samba were also affected. Security release announcement is here: https://www.samba.org/samba/security/CVE-2020-1472.html https://www.samba.org/samba/security/CVE-2020-1472.html After a previous vulnerability we changed our defaults to require schannel for release 4.8, which protects against the CVE-2020-1472 problem, but admins could turn off this protection to work with older/less secure products. Further hardening of Samba is currently taking place to protect our users from the bug.
- deleted 6y ago
  [deleted]
- malwarebytess 6y ago
  Does this mean that any server that uses Samba, windows or not, is vulnerable?
  - tcmb 6y ago
    Looks like it, there is also a security issue released for Ubuntu: https://usn.ubuntu.com/4510-1/ https://usn.ubuntu.com/4510-1/
    - secabeen 6y ago
      Only if you are running the Samba DC functionality, which is non-default. Also, you would have needed to specifically disable the protection that was added by Samba in 2018.
  - deleted 6y ago
    [deleted]
  - tialaramex 6y ago
    If the server provides Domain Controller capability then yes, it implements NetLogon, Microsoft's NetLogon protocol is vulnerable to this attack by design and so Samba in that scenario is potentially vulnerable and has the same mitigation strategy that Microsoft applied. If it's not a Domain Controller then this is irrelevant.
fortran77 6y ago
In general, when your OS or system software (Database, Webserver, etc.) vendor releases a patch for an exploitable vulnerability, this requires immediate attention.
- 2snakes 6y ago
  A patch is a global vulnerability alert.
clouddrover 6y ago
How long has this vulnerability been known but kept quiet for use in the NSA's library of exploits? EternalBlue was based on a Windows exploit they knew about but withheld from Microsoft so they could continue to exploit it. That deliberate withholding of information has cost many organizations a lot of money: https://www.forbes.com/sites/kalevleetaru/2019/05/25/as-eternalblue-racks-up-damages-it-reminds-us-there-is-no-such-thing-as-a-safe-cyber-weapon/ https://www.forbes.com/sites/kalevleetaru/2019/05/25/as-eter... https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-balti... Is this another problem that could have been fixed a long time ago?
- deleted 6y ago
  [deleted]
- deleted 6y ago
  [deleted]
- srtjstjsj 6y ago
  > Is this another problem that could have been fixed a long time ago? Yes. The bug was documented in the public documentation, not even hidden in the closed source code.
doctoboggan 6y ago
Wow, the hospital my wife works at was hit with a ransomware attack today, I wonder if this is the vector the attacker used.
- resfirestar 6y ago
  If they had a domain controller with ports opened to the internet they would have been hit some other way already (not to mention suffering from constant account lockouts from random brute forcing), so this would probably not be the initial vector. Once the exploits are more polished this will make things easier for ransomware to escalate privileges but they already had effective ways to get to domain admin that work on most networks.
greesil 6y ago
Sorry for my ignorance, but do Linux servers have critical vulnerabilities like this, and as frequently? Edit: thanks for downvoting a serious question.
- resfirestar 6y ago
  Generally no, for many reasons. I think the most important one here is that in a Windows server there’s a lot of software bundled together (AD services, the SMB server, IIS, RPC stuff like this netlogon interface, WMI, RDP, many others) that you can generally expect to find on any Windows server, giving you a wealth of targets and potential ways to exploit how different components interact. A base Linux system has relatively few services (just SSH in simple distributions) so to begin targeting Linux the same way you’d have to decide to go after RHEL or something, narrowing an already tiny share of servers down even further. Other reasons include the dominance of Windows outside the tech industry (which makes it a more interesting and lucrative target for vulnerability researchers and exploit developers), lack of comparable functionality to AD for Linux servers, and probably higher standards for code quality and cryptography in highly scrutinized open source applications like MIT Kerberos.
  - stinos 6y ago
    A base Linux system has relatively few services (just SSH in simple distributions) so to begin targeting Linux the same way you’d have to decide to go after RHEL or something Not sure why it shuold be REHL, there are linux counterparts for most bundled software you mention so a comparison against a base linux system + e.g. samba/vnc/nginx/... still seems fair. All of those have had (sometimes severe i.e. root escalation) vulnerabilities in the past, but answering the question whether it's 'as frequent' is pretty hard to answer. I would also guess towards 'no' though.
    - resfirestar 6y ago
      Yeah, there are applications that are very common, but still exploits against them won’t be as universally applicable as Windows ones. You’re likely to find a Linux server with either Samba or nginx or some VNC software but all at once is less common, and there’s a lot of variety with web and VNC servers.

425 points by ohjeez 6y ago

collsni 6y ago

This is from a month ago, if you patched your DCs in August you are good.

dfv 6y ago

Microsoft really can't catch a fucking break this year, can they?

chromedev 6y ago
Poor Microsoft. They are so ethical. /s
giancarlostoro 6y ago
Their stock has done mighty fine. Before anyone says if its down now check how much its gone through YTD. I still feel like their stocks highly undervalued considering where their competitors stock is at.
dylan604 6y ago
It's 2020 for Microsoft just like it is for the rest of us.

MattGaiser 6y ago

> We have directed agencies to implement the patch across their infrastructure by Monday, September 21 Actually, they have until Monday.

acqq 6y ago

It I see it correctly, it's about "August 2020 security update" which was published 11 Aug 2020, more than a month ago.

MrMorden 6y ago
Correct. And "government-grade security" isn't a compliment. CISA definitely has some people who want to do the right thing, but they need budgetary control over other agencies to make it happen. (Speaking as someone who worked for the federal government for 15+ years, the most effective means of persuasion would be travel and reserved parking enforcement for Senior Executive Service members.) CISA also doesn't have authority over DoD or IC systems, let alone the aforementioned budgetary authority to make them do it. No, it doesn't make any sense to apply a lesser standard to systems that are more sensitive. Like I said, government-grade security.
- tialaramex 6y ago
  The financial sector is also terrible. During SHA-1 deprecation for example, almost all the trouble was with the financial sector. The way the bogus issuance that led to discovering problem at StartCom / WoSign was detected begins with a financial services company that is desperately trying to get a SHA-1 certificate issued after it's too late and finds WoSign will back date the certificate for some undisclosed amount of money. Even some of the Symantec / Crosscert stuff comes back to the Korean banking and financial sector, (in the district south of the river in Seoul which we'd anglicize "Gangnam" yes that Gangnam...). And lots of "We must have RSA kex" was the financial sector too. You've probably got a chip card as credit card or debit card, but even though that chip is relatively a technological heavyweight (compared to things like your employee badge that authorises access to the shared office printer, or a public transit card) the crypto in it is... not so hot, and the surrounding infrastructure built by financial companies is awful. And the chip card doesn't actually secure the thing you care about - your money - it only secures the thing the issuer cares about, tying your transaction to you. Actual financial transfers are done entirely on a trust basis like it's still the 19th century, the card just presents authorization which is optional.
  - vjt 6y ago
    what I find most frustrating is that finance institution buy extremely overpriced and brittle software from renowned vendors not because of technical excellence but for risk management: they want a supplier to blame when something goes wrong. the problem with this is that nowadays suppliers are stronger in defending themselves from such blames than they are in writing good software. furthermore, the software being sold is very pricey and the cost of customising it often exceeds the cost of the software itself. then, 9 times out of 10 the issues lie in the customisations, and that doesn’t surprise, as the institution will be using most the custom parts as those are the ones they need most. here the vendors have even more grip in demonstrating that it’s the customer requirements’ fault, and not their crappy software, that confuses the concepts of “database” and “application server”. I try to counter this by writing solid, robust software using open source components, giving back when possible, perfectly filling the company’s requirements, well integrated and reasonably cheap to maintain. slowly, this can help in abandoning vendors and building in-house know-how. I find this crucial because the quality of software sold by some vendors is very very low, and getting worse.

ComodoHacker 6y ago

Microsoft Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472

waihtis 6y ago

Exploits for this have been floating on Github for at least a week already. The vulnerability game has become pretty fast paced nowerdays..

GEBBL 6y ago

They are slow off the mark here

gjsman-1000 6y ago

I've used Linux so much, I initially read the title as "Window (singular) Server Vulnerability...", leading me to wonder what was wrong with Xorg this time...

sk5t 6y ago
Isn't Xorg technically the Xwindows client?
- racingmars 6y ago
  No, Xorg (or at least the component of Xorg I think you're thinking about) is the server -- specifically, the display server. Clients -- the individual applications you run -- connect to the display server to draw themselves. (so, e.g., xeyes, xlogo, Firefox, etc. are the clients).
- hackbinary 6y ago
  Technically it is the X Window System. :) https://en.m.wikipedia.org/wiki/X_Window_System https://en.m.wikipedia.org/wiki/X_Window_System
- jacquesm 6y ago
  A certain Don Hopkins has written about this: "We have tried to avoid paragraph-length footnotes in this book, but X has defeated us by switching the meaning of client and server. In all other client/server relationships, the server is the remote machine that runs the application (i.e., the server provides services, such as database service or computational service). For some perverse reason that's better left to the imagination, X insists on calling the program running on the remote machine "the client." " From: http://www.art.net/~hopkins/Don/unix-haters/x-windows/disaster.html http://www.art.net/~hopkins/Don/unix-haters/x-windows/disast...
  - marcosdumay 6y ago
    Things are complicated when the remote computer calls your desktop. But that's how X works. That's also why once in a while somebody discover a completely unexpected vulnerability on it that, although simple nobody thought about it before. Things are so non-intuitive that it's hard even to talk about them. Yet, somehow it works. And works quite well. I imagine the authors of that book are quite annoyed by how Unix evolve to work really well, and still avoided fixing any fundamental problem.

cpach 6y ago

There was a patch released last Tuesday, wasn’t it? Not so fun though for those who still are on Server 2008 though. (Yes, that is still a thing unfortunately.)

PakG1 6y ago
I'm trying to get off! It's not easy! These apps won't run on a later version of Windows Server, they're too old! Tell my boss to give me more budget to get things done properly! :(
- vaccinator 6y ago
  > Tell my boss to give me more budget to get things done properly How much would someone get for getting this done?
  - chucky_z 6y ago
    Usually $0. I've been in this situation. Getting a $1000 budget approval took months and was _tough_.
  - PakG1 6y ago
    Getting the app upgraded or changed to not need 2008 is the hard part. If the app could run on a later version of Windows, this would be really easy. I'm sure you can appreciate how difficult that might be. For custom apps, it could be a lot of code to update. For vendor apps, that app would also probably need to be upgraded to a newer version because the app is also end of life for some years now. In our case, it's a vendor app. No time and money to fix this situation, so we just keep it running and pray.
- slaymaker1907 6y ago
  Why would that affect what the DC server is? Usually those are run as dedicated servers.
  - PakG1 6y ago

KindOne 6y ago

This has been posted on /r/sysadmin on Reddit: https://www.reddit.com/r/sysadmin/comments/i7yh5d/cve20201472_netlogon_elevation_of_privilege/ https://www.reddit.com/r/sysadmin/comments/i7yh5d/cve2020147... Twitter post explaining it: https://twitter.com/RyanLNewington/status/1293444151644626944 https://twitter.com/RyanLNewington/status/129344415164462694... Blog post explaining it: https://www.tenable.com/blog/cve-2020-1472-zerologon-vulnerability-in-netlogon-could-allow-attackers-to-hijack-windows https://www.tenable.com/blog/cve-2020-1472-zerologon-vulnera... POC: https://infinitelogins.com/2020/09/15/abusing-cve-2020-1472-zerologon/ https://infinitelogins.com/2020/09/15/abusing-cve-2020-1472-...

AlphaMaelstrom 6y ago
I missed this on reddit though, so more coverage is a good thing. Need to make sure all our managed servers aren't behind on any updates first thing monday.
WalterSobchak 6y ago
Whitepaper for CVE-2020-1472: https://www.secura.com/pathtoimg.php?id=2055 https://www.secura.com/pathtoimg.php?id=2055 [PDF]
javajosh 6y ago
"Microsoft provided patches for CVE-2020-1472 in August"

galacticaactual 6y ago

Script to test vulnerable domain controllers here: https://github.com/SecuraBV/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472

kregasaurusrex 6y ago

Here's the description for CVE-2020-1472: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

tialaramex 6y ago
This is an amazing bug. So what happens is, you're supposed to fill out a bunch of bytes as proof of who you are, and then a bunch of bytes that represent stuff like seconds since the start of the Unix epoch. If you can't do this, NetLogon figures you aren't really who you say you are. And the exploit is: Fill everything out with all zeroes. This will succeed one time in 256 on average. The reason why is complicated and somewhat interesting, but this stupidest possible exploit is what you get at the end of that complicated rationale. I've written previously on HN that it stands out how terrible Microsoft is at cryptographic design. If there's an opportunity to roll your own and do it badly, in a Microsoft product that's what you should expect. Google has good people (it doesn't always use them, but most often it does) for this stuff, and Apple most often seems to accept that it doesn't have good people so it'll not roll its own but just use things that already exist; but Microsoft does this over and over. In this particular case they took AES (seems fine) and an inappropriate but in principle secure cipher mode (CFB8) and then they... fixed the IV as all zeroes even though the definition of CFB is clear that you need to use a random IV.
- ziml77 6y ago
  > Apple most often seems to accept that it doesn't have good people so it'll not roll its own but just use things that already exist Do they? Wasn't "goto fail" a bug in their SSL code? That one wasn't even a bug that a reviewer would need to reason about the logic of the code to see.
  - tialaramex 6y ago

jimrandomh 6y ago

This refers to a vulnerability that was patched in August; any systems that are still unpatched are over a month behind. In general, most security patches (for any software that's in use) are urgent; once a patch is out, some adversaries are going to reverse-engineer the patch to find out what the bug was, and mass-exploit targets that haven't patched. Any server which is that far out of date on its patches is either in need of a sysadmin, or has a sysadmin who's being negligent. There is no excuse.

acdha 6y ago
You’re missing the biggest reason this is relevant: enterprise IT shops with strict change management processes amd, especially in government, years of austerity budgets cutting resources for both sysadmins and rigorous testing. Either of the targets you mentioned are more the symptom than the root cause: management setting up bad incentives. If you have a charge management process which takes a month to approve updates, the problem is not the sysadmin. If years of skimping means that the operators are afraid to patch because they’ll be punished if it breaks things and they don’t have a robust testing process, the problem is not the sysadmin.
- taf2 6y ago
  I feel these organizations that have a process that prevents critical fixes have a broken process... you either have to be ok with having your servers compromised eg data stolen or leaking user data or you have to be ok accepting that sometimes the engineer fixing a bug, adding a new feature might mess something up. I am inclined to believe a bit more to the side of move fast break things is bette than move so slow you get pwned... but sort of a delicate balancing act...
  - TheAdamAndChe 6y ago
    I studied IT security quite a lot, and implement Windows patches for dozens of companies. While you are technically right, Microsoft releases broken patches _constantly_. If we pushed out every single patch the moment they were released, we would constantly be down and fighting fires. Most small and mid-sized companies don't have hacking campaigns run against them most times. Given this, it just doesn't make sense to push out every single patch immediately. Microsoft's patches are a whole lot more stable when they're a couple months old.

vic_acid 6y ago

Well no, it required immediate attention over a month ago. Who are these incompetents not patching their servers for months on end?!

Snowbirth 6y ago

1472 patched here too https://blog.0patch.com/ https://blog.0patch.com/ https://0patch.com/ https://0patch.com/ Great for old systems where updating breaks stuff

jra_samba 6y ago

As this is a protocol level vulnerability, older versions of Samba were also affected. Security release announcement is here: https://www.samba.org/samba/security/CVE-2020-1472.html https://www.samba.org/samba/security/CVE-2020-1472.html After a previous vulnerability we changed our defaults to require schannel for release 4.8, which protects against the CVE-2020-1472 problem, but admins could turn off this protection to work with older/less secure products. Further hardening of Samba is currently taking place to protect our users from the bug.

deleted 6y ago
[deleted]
malwarebytess 6y ago
Does this mean that any server that uses Samba, windows or not, is vulnerable?
- tcmb 6y ago
  Looks like it, there is also a security issue released for Ubuntu: https://usn.ubuntu.com/4510-1/ https://usn.ubuntu.com/4510-1/
  - secabeen 6y ago
    Only if you are running the Samba DC functionality, which is non-default. Also, you would have needed to specifically disable the protection that was added by Samba in 2018.
- deleted 6y ago
  [deleted]
- tialaramex 6y ago
  If the server provides Domain Controller capability then yes, it implements NetLogon, Microsoft's NetLogon protocol is vulnerable to this attack by design and so Samba in that scenario is potentially vulnerable and has the same mitigation strategy that Microsoft applied. If it's not a Domain Controller then this is irrelevant.

fortran77 6y ago

In general, when your OS or system software (Database, Webserver, etc.) vendor releases a patch for an exploitable vulnerability, this requires immediate attention.

2snakes 6y ago
A patch is a global vulnerability alert.

clouddrover 6y ago

How long has this vulnerability been known but kept quiet for use in the NSA's library of exploits? EternalBlue was based on a Windows exploit they knew about but withheld from Microsoft so they could continue to exploit it. That deliberate withholding of information has cost many organizations a lot of money: https://www.forbes.com/sites/kalevleetaru/2019/05/25/as-eternalblue-racks-up-damages-it-reminds-us-there-is-no-such-thing-as-a-safe-cyber-weapon/ https://www.forbes.com/sites/kalevleetaru/2019/05/25/as-eter... https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-balti... Is this another problem that could have been fixed a long time ago?

deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
srtjstjsj 6y ago
> Is this another problem that could have been fixed a long time ago? Yes. The bug was documented in the public documentation, not even hidden in the closed source code.

doctoboggan 6y ago

Wow, the hospital my wife works at was hit with a ransomware attack today, I wonder if this is the vector the attacker used.

resfirestar 6y ago
If they had a domain controller with ports opened to the internet they would have been hit some other way already (not to mention suffering from constant account lockouts from random brute forcing), so this would probably not be the initial vector. Once the exploits are more polished this will make things easier for ransomware to escalate privileges but they already had effective ways to get to domain admin that work on most networks.

greesil 6y ago

Sorry for my ignorance, but do Linux servers have critical vulnerabilities like this, and as frequently? Edit: thanks for downvoting a serious question.

resfirestar 6y ago
Generally no, for many reasons. I think the most important one here is that in a Windows server there’s a lot of software bundled together (AD services, the SMB server, IIS, RPC stuff like this netlogon interface, WMI, RDP, many others) that you can generally expect to find on any Windows server, giving you a wealth of targets and potential ways to exploit how different components interact. A base Linux system has relatively few services (just SSH in simple distributions) so to begin targeting Linux the same way you’d have to decide to go after RHEL or something, narrowing an already tiny share of servers down even further. Other reasons include the dominance of Windows outside the tech industry (which makes it a more interesting and lucrative target for vulnerability researchers and exploit developers), lack of comparable functionality to AD for Linux servers, and probably higher standards for code quality and cryptography in highly scrutinized open source applications like MIT Kerberos.
- stinos 6y ago
  A base Linux system has relatively few services (just SSH in simple distributions) so to begin targeting Linux the same way you’d have to decide to go after RHEL or something Not sure why it shuold be REHL, there are linux counterparts for most bundled software you mention so a comparison against a base linux system + e.g. samba/vnc/nginx/... still seems fair. All of those have had (sometimes severe i.e. root escalation) vulnerabilities in the past, but answering the question whether it's 'as frequent' is pretty hard to answer. I would also guess towards 'no' though.
  - resfirestar 6y ago
    Yeah, there are applications that are very common, but still exploits against them won’t be as universally applicable as Windows ones. You’re likely to find a Linux server with either Samba or nginx or some VNC software but all at once is less common, and there’s a lot of variety with web and VNC servers.