Managed Event Collection

URGENT | Fortinet Authentication Bypass Vulnerability

On October 10, 2022, Fortinet, Inc released a new advisory for CVE-2022-40684 which affects the FortiOS, FortiProxy and FortiSwitchManager products.

Each of these products are vulnerable to an authentication bypass vulnerability. This vulnerability could allow an attacker to perform unauthenticated actions on the target system. These actions include, but are not limited to:

Modifying admin user SSH keys.
Adding new local users
Updating network configurations to reroute traffic
Initiating packet captures to capture sensitive information

Publicly available exploit code is now starting to become available.

Affected Products

FortiOS version 7.2.0 through 7.2.1
FortiOS version 7.0.0 through 7.0.6
FortiProxy version 7.2.0
FortiProxy version 7.0.0 through 7.0.6
FortiSwitchManager version 7.2.0
FortiSwitchManager version 7.0.0

Solutions

Upgrade to FortiOS version 7.2.2 or above
Upgrade to FortiOS version 7.0.7 or above
Upgrade to FortiProxy version 7.2.1 or above
Upgrade to FortiProxy version 7.0.7 or above
Upgrade to FortiSwitchManager version 7.2.1 or above

Read more in:

www.fortiguard.com: FortiOS / FortiProxy / FortiSwitchManager – Authentication bypass on administrative interface
docs.fortinet.com: FortiOS Release Notes for FortiOS 7.2.2 build 1255
www.darkreading.com: Patch Now: Fortinet FortiGate & FortiProxy Contain Critical Vuln
www.bleepingcomputer.com: Fortinet says critical auth bypass bug is exploited in attacks

Ongoing penetration testing and vulnerability management can alert you to these types of vulnerabilities being present in your environment. nGuard account executives are standing by to discuss solutions that elevate the overall security posture of your organization and ensure you are ready to handle vulnerabilities such as the ones described above.

Microsoft Exchange Zero-Days Mitigated, Then Bypassed!

Earlier this month two new zero-day exploits, CVE-2022-41040 and CVE-2022-41082, were released and code named ProxyNotShell due to similarities to another set of flaws called ProxyShell. nGuard covered one of the more recent Exchange zero-day vulnerabilities last year in another security advisory.

CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability with 8.8 severity score out of 10. CVE-2022-41082 has been rated a 6.3 severity score out of 10 and allows Remote Code Execution (RCE) when PowerShell can be access by a malicious attacker. These vulnerabilities affect Microsoft Exchange Server 2013, 2016, and 2019 for on-premises deployments. Microsoft stated, “While these vulnerabilities require authentication, the authentication needed for exploitation can be that of a standard user. Standard user credentials can be acquired via many different attacks, such as password spray or purchase via the cybercriminal economy.”

If an attacker can successfully exploit these vulnerabilities, they can compromise the victim’s system, obtain a web shell and install it, then attempt to pivot to other hosts on the network for further compromise. Microsoft said, with medium confidence, they can attribute many of the already carried out attacks to state-sponsored actors. These state-sponsored actors installed the China Chopper web shell to facilitate hands-on-keyboard access, which the attackers used to perform Active Directory reconnaissance and data exfiltration.

Microsoft has yet to release a patch for these vulnerabilities but did release workarounds for these two zero-days. However, shortly after their release it was discovered the recommended fix could be easily circumvented. This caused Microsoft to rewrite the mitigation to take this into account:

Open IIS Manager
Select Default Web Site
In the Feature View, click URL Rewrite
In the Actions pane on the right-hand side, click Add Rule(s)…
Select Request Blocking and click OK
Add the string “.*autodiscover\.json.*PowerShell.*” (excluding quotes)
Select Regular Expression under Using
Select Abort Request under How to block and then click OK
Expand the rule and select the rule with the pattern: .*autodiscover\.json.*Powershell.* and click Edit under Conditions
Change the Condition input from {URL} to {REQUEST_URI}

Microsoft also released a PowerShell script to apply the mitigation.

Outside of the Microsoft mitigations, you can protect your organization by:

Updating firewall rules, IPS, IDS systems to block known IP addresses targeting this vulnerability. You can download an updated list of malicious IPs and manually enter them in your perimeter protection devices.
Implementing multi-factor authentication (MFA) and training users not to accept unwanted MFA prompts.
Disabling Exchange Legacy Authentication.
Having a SIEM to help respond to ongoing threats to your environments based on correlating events from logs.
Ensuring you have a robust vulnerability management program in place to stay on top of the latest threats.
Conducting penetration testing on a frequent basis to ensure that attackers have limited or no path to pivot throughout your networks.
Either having an Incident Response retainer in place or having a pre-selected vendor to call should your organization fall victim to zero-days like this or any other attack.

TWiC | Lapsus$ Ransomware, LastPass Hack & MS ZeroDay

The past couple of weeks have been busy ones for the world of cybersecurity. Multiple companies have disclosed serious hacks that have led to breaches of customer data and overall system availability. In this week’s security advisory, nGuard will detail some of these incidents and their impact on the cybersecurity landscape.

Cisco Data Breach Attributed to Lapsus$ Ransomware Group

The Lapsus$ crime gang is back at it again with an attack on the networking giant, Cisco. About a month ago, Cisco had disclosed that its systems were breached. A social engineering attack led adversaries on a pathway to overtaking an employee’s Google account. Saved credentials were then obtained from the browser and voice communications were utilized to trick the unsuspecting employee into accepting a multi-factor authentication push notification. Cisco believes the end goal of the attacker was to deploy ransomware on the network after gaining access to multiple systems. Cisco is reporting that attempts to deploy ransomware were unsuccessful.

LastPass Says Hackers Had Internal Access For Four Days

Lastpass reported a breach back in August and are now releasing some more details about the compromise. They are now reporting that an attacker had internal access to the company systems for four days before they were detected. Lastpass worked with a cybersecurity firm to investigate the incident and found that no customer data or password vaults were accessed during this time. LastPass maintains that your master password, and the keys used to encrypt and decrypt data, are never sent to LastPass’ servers, and are never accessible by LastPass. The attacker was however able to access a developer endpoint and poke around the development environments.

Microsoft Patches a New Zero-Day Affecting All Versions of Windows

Microsoft is patching another zero-day vulnerability affecting all supported versions of Windows. This zero-day is reported as being used in real-world attacks. CVE-2022-37969 is a privilege elevation flaw in the Windows Common Log File System Driver. This is utilized for data and event logging. Once a system is compromised, this vulnerability can be used to escalate user privileges to the highest level, SYSTEM. 4 different security firms reported this vulnerability to Microsoft which makes them believe this could be widely used in real-world scenarios. They recommend patching immediately.

nGuard closely monitors trends in the world of cybersecurity and applies those trends to assessment activities and managed security services. Having penetration testing conducted periodically against network assets, web applications, and other critical infrastructure can prevent data breaches before they happen. Putting your employees through social engineering campaigns to test their security readiness can boost awareness. Having a security first mindset is essential in protecting the valuable data of organizations.

Vulnerability Exploits Overtake Phishing as Initial Attack Vector

Most security professionals will advise the number one way attackers gain an initial foothold on a network is, and continues to be, phishing and social engineering attacks. Palo Alto recently released their 2022 Incident Response Report which confirmed what most would say is true. At a combined 42%, phishing and social engineering make up almost half of all means of initial access.

The second most common way according to the above chart from Palo Alto is software vulnerabilities. However, in the first week of September, Kaspersky released its 2021 Incident Response Overview and it told a different story. 53.6% of the initial attack vectors they responded to were exploits of public-facing applications.

2021 had no shortage of time sensitive critical vulnerabilities including Log4j, Microsoft Exchange ProxyLogon, and three other CVEs related to the ProxyLogon vulnerabilities that were released in March of 2021. When these vulnerabilities are made publicly available it is only a matter of minutes before publicly facing systems are being scanned for vulnerable targets. Within hours, proof of concept exploits become available leading to an extremely high rate of organizations falling for such attacks.

In recent years, organizations have prioritized security awareness training and conducted social engineering and phishing training. But have those same organizations made it a priority to have a vulnerability management program in place?

How can organizations stay ahead of these attack trends? Start by building out a mature security program that includes annual penetration testing, ongoing vulnerability scanning, and a properly configured SIEM to alert on network anomalies. If you suspect a breach, identify a firm capable of responding to security incidents and secure an incident response retainer. Lastly, have an expert conduct a strategic security assessment to compare your organization’s security program to a known security standard like the Center for Internet Security Critical Security Controls.

Password Guidelines You Need To Know

Conventional wisdom says passwords should be longer than 8 characters, they should contain complexity with upper case, lower case, numbers, and symbols, and Rotating passwords periodically is crucial to prevent them from being compromised. Consider rethinking your password requirements if this is still how you instruct your employees. In this security advisory, nGuard will lay out the password requirements you should be utilizing for employees.

Entropy is defined as “a measure of the amount of uncertainty an attacker faces to determine the value of a secret.” Traditionally, it was believed that entropy could be increased by requiring users to change their passwords frequently and by increasing the complexity of passwords. We now know that this is not the case. Length alone can provide password entropy at any level. Furthermore, if you change your passwords numerous times a year, you may find it difficult to remember passwords with high levels of complexity. Let’s take a look at some examples:

Password: nGu@rd2022!

This is an 11-character password with a high level of complexity. According to security.org, it would take a computer about 400 years to crack this password using brute force methodology. Engineers at nGuard say this password has a high probability of being cracked very quickly. It uses the company name with some common substitutions such as the “@” instead of the “a.” It also uses the current year, which is common among companies that force password changes on a regular basis.

Password: nGuard is a leading provider of security

This is a 40-character password with a low level of complexity. According to security.org, it would take a computer about 88 septendecillion years to crack this password using brute force methodology. Septendecillion is a 1 followed by 54 zeros. That’s a lot! The length of this password makes it more difficult to crack, but it is easier to remember and type out. Passwords like this won’t need to be changed unless they become compromised through social engineering or some form of clear-text password compromise.

In order to avoid forcing users to reset their password on a regular basis, nGuard recommends using password phrases like the example above. Set up alerts to notify IT when a specific account experiences too many failed login attempts. Additionally, limit the number of failed login attempts allowed within a certain time frame. With nGuard’s Managed Event Collection & Correlation (MECC) service, these types of things can be monitored. For an organization to maintain a strong password posture, that’s all you need to do. Your organization’s password security posture will be at the forefront of the industry if you do all of this and implement multi-factor authentication if possible.

Following the implementation of a strong password policy, nGuard can provide a variety of services to make sure you’re on the right path. Password Database Audits allow you to test the strength of your passwords against industry leading password crackers. By performing an internal penetration test, you can make sure that passwords are not being stored on machines in a way that makes them insecure (for instance, in plaintext).

PCI DSS v4.0 – First Look

On March 31, 2022, the PCI Security Standards Council (PCI SSC) issued version 4.0 of the PCI Data Security Standard (PCI DSS). In the security advisory video below, you can join nGuard’s Eric Consford, Jim Brown, Chris Lau, and Zack Thornton for a first look at PCI DSS v4.0. In this video advisory, we take a quick look at the coming changes in v4.0 of the PCI DSS standard.

nGuard offers a wide variety of services for our customers that seek PCI compliance. From security advisory services that get all your questions answered to full merchant and service provider QSA audits, nGuard can assist you every step of the way.

Managed Event Collection

Learn how nGuard can secure your data

Chat Popup