I'm sure most of you have now heard of a high-risk Windows server - called Zerologon - that would allow hackers to take over business networks completely.
For those of you who don't know, in short, all supported versions of Windows Server applications are at risk of a serious patent infringement that resides in the Netlogon Remote Control Protocol for Domain Controllers.
In other words, the primary vulnerability (CVE-2020-1472) can be exploited by the attacker to stop Active Directory services, and ultimately, the Windows domain without the need for authentication.
What’s worse is that the exploitation of evidence of this error was released to the public last week, and soon after that, the attackers began exploiting vulnerabilities through programs that were not included in the wild.
As explained in our compilation based on technical analysis published by Cynet's security analysts, the main problem is Microsoft's implementation of AES-CFB8, where it failed to use the unique, random salt of these Netlogon messages.
An attacker needs to send a specially designed egg string to Netlogon messages to change the domain control password stored in Active Directory.
For THN readers who are interested in learning more about this threat in detail, including technical details, mitigation, and discovery strategies, they should join the live webinar (register here) with Aviad Hasnis, CTO at Cynet.
A free security safety education webinar is scheduled for 30 September at 5:00 PM GMT, and aims to discuss wildlife exploitation to take advantage of this crisis.
In addition, the Cynet team has also released a free discovery tool that warns you of any Zerologon abuse in your area.
Comments
Post a Comment