3 Vulnerabilities were Found In Netgear Routers, Ransomware Hits Businesses Worldwide,
and PrintNightmare Leads to remote code execution attacks! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for July 6,
2021! This is your weekly summary of the threats to our security, privacy and Internet freedom.
FYI Hak5 fans! The team just released a brand new Bash Bunny on the Hak5 shop,
and my patrons automatically get a discount as a perk. Check it out, support the brand, so we
can keep making free content like this! We have a bunch of xxx to get into, so.. Onto the news!!
Attackers could bypass authentication and take over Netgear routers, as well as access
stored credentials, using three different bugs discovered by Microsoft security researchers.
These vulnerabilities were found in the Netgear DGN-2200v1 series of routers
while the researchers were doing work on device fingerprinting - at which time they
noticed odd behavior where a non-IT personnel was trying to access the router’s management port.
The details of the vulns are included in the Microsoft 365 Defender team blog
Netgear did patch these three bugs way back in December, which are tracked as PSV-2020-0363,
0364, and 0365 and range from a 7.4 to 9.4 in severity. When researchers noticed the activity,
they downloaded the router firmware and analyzed the HTTPd binary since the odd traffic was
happening on that port. They found they could successfully achieve a complete and fully reliable
authentication bypass. They also found they could grab the router credentials using a side
channel attack, then they tried to grab the creds using the backup and restore features
and found that worked too. These could allow an attacker to gain access to any page on a router
management GUI, including ones that required authentication by appending GET variables.
The HTTP headers had an issue in how they verify users, which leads to the side channel attacks.
And the third issue had to do with the researchers using the first flaw
to extract the router config restore file - It was encrypted,
yes, using a constant key, spelled “NtgrBak”, and that allowed for extracting stored creds.
Even though these were patched in December, I’m well aware many home users never update their
routers. So add it to your summer cleaning, check your router for updates, and do a quick patch.
The Enterprise IT firm Kaseya confirmed they were hit with ransomware attacking
their VSA product which is used for remotely monitoring point of sale systems, networks,
PCs, and connected devices. This happened during the holiday weekend. Kaseya believes
this only affected their on-premises customers only due to their fast response, but later,
other customers like managed service providers, revealed they were affected as well.
This issue actually impacts well over 1000 businesses according to some reports,
but the exact total is currently unknown. Kaseya supports over 40,000 businesses worldwide.
Businesses affected included a supermarket chain from Sweden
but no other businesses have come forward saying they were affected at time of recording.
The Revil ransomware gang announced they were behind this attack and demanded a
payment of $70 million in bitcoin before they would publicly publish a decryptor key
for all victims. None of the victims reported that data was stolen.
It appears this attack happened and was successful due to a zero day vulnerability in the Kaseya
VSA - specifically an authentication bypass vulnerability in the web interface. Kaseya
took their on premises servers totally offline as soon as they realized the attack was occuring.
CISA and the FBI issued a joint advisory, recommending customers using VSA download the
VSA detection tool, which can also detect REvil components. They also recommend using MFA on all
accounts. An investigation is currently ongoing. Big shoutout to my Hush Puppy perk level patrons
for sharing their fur baby photos and for the support. And a quick shoutout to Neil, Reuben,
Morks, and Mario for joining the ThreatWire alliance and as always, for supporting the show!!
Check out the Patreon Alliance for info on the new Hak5 Shop coupon code and your exclusive
access to an audio only podcast version of this show. Onto the third news story.
Last Tuesday, a proof of concept exploit was dropped on GitHub which turns out was
a critical Windows security vulnerability in the Windows Print Spooler. It was removed from GitHub
hours later, but that was plenty of time for it to get copied and circulated. It’s now being called
PrintNightmare and it was originally an elevation of privilege problem that was addressed in June’s
Patch Tuesday, but was later found to also lead to a remote code execution attack - and that patch
did not fix this RCE flaw. Some security experts are saying that these two exploits are different,
but Microsoft first was notating this new RCE flaw as a part of the original issue.
But according to one of the original researchers - one that found the flaw that was patched - that
patch is incomplete and was meant to fix this RCE problem, but didn’t include it.
The vulnerability is tracked as CVE-2021-1675. But after the RCE vulnerability was introduced, again
called Print Nightmare, Microsoft assigned a new CVE - CVE-2021-34527, for this one, separating it
from the original issue that was patched - because it used a different attack vector - and it affects
Windows 7 up to Windows 10 along with Server 2008 to Server 2019 - 40 different systems in total.
Confusing as all of that was… it’s still a serious problem that should be known about.
Security firm Sangfor posted a whole technical analysis of this issue on Github along with the
POC code. It got cloned and shared by security researchers, some of whom shared their own POCs.
So since this is likely to be exploited, security experts are recommending that consumers and
businesses should disable the Spooler service within their environment - although most clients
will be safe because of the default Windows Firewall rules. I mention Spooler service
because the victim has to be targeted for it to work - and that victim has to be authenticated
to the Spooler service - the attacker has to authenticate as a domain user. A low level
user could exploit it so phishing could come into play in order for an attacker to achieve success.
That Spooler service is usually enabled, so if targeted, it could be easy to exploit.
For now, it appears the best option is to disable the service on the domain controller
or disable inbound remote printing through the Group Policy. That means you won’t be
able to print remotely, you’ll have to plug directly into a printer to print to it, but
at least it would protect from inbound attacks. ZeroPatch has also released “micropatches” that
are unofficial but should block any attackers from being able to exploit it on vulnerable networks.
This week on Morse Code I’m continuing the new studio build so you can check
out the final construction phase and see the build plan! This episode is being
recorded in this new studio space so… growing pains… bear with me as it’s not
completely set up yet. Subscribe to my channel - youtube.com/shannonmorse - for more. I’ll be
out for two weeks visiting my family so I’ll be back soon, And with that, don't forget to like
and subscribe to this channel as well! I'm Shannon Morse, I'll see you on the Internet!