CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner
Researchers identify the first in-the-wild exploit of the BlueKeep vulnerability nearly six months after it was disclosed.
背景
On November 2, security researchers Kevin Beaumont (@GossiTheDog) and Marcus Hutchins (@MalwareTechBlog) confirmed the first in-the-wild exploitation of CVE-2019-0708, also known as BlueKeep.
分析
CVE-2019-0708, a critical remote code execution vulnerability in Microsoft’s Remote Desktop Services, was patched back in May 2019. The vulnerability raised eyebrows, particularly because Microsoft released security updates for out-of-support versions of Windows, in an effort to thwart a potential worm that could spread just as WannaCry did in 2017. Beaumont is credited with naming the vulnerability “BlueKeep,” inspired by Game of Thrones. He subsequently set up BlueKeep honeypots to keep tabs on global attempts to exploit the flaw in-the-wild.
CVE-2019-0708 RDP vulnerability megathread, aka BlueKeep.
— Kevin Beaumont (@GossiTheDog) May 14, 2019
Going to nickname it BlueKeep as it’s about as secure as the Red Keep in Game of Thrones, and often leads to a blue screen of death when exploited.
This weekend, Beaumont observed blue screens of death (BSODs) for his BlueKeep honeypots starting on November 2.
huh, the EternalPot RDP honeypots have all started BSOD'ing recently. They only expose port 3389. pic.twitter.com/VdiKoqAwkr
— Kevin Beaumont (@GossiTheDog) November 2, 2019
Beaumont shared a kernel crash dump from his honeypots with Hutchins, who confirmed this as the first exploitation of BlueKeep in the wild.
Blog post on how I discovered mass exploitation of BlueKeep from a kernel dump of a crashed system. https://t.co/2tLdLNosYt
— MalwareTech (@MalwareTechBlog) November 3, 2019
Hutchins shared his analysis in a blog post, where he identified the attackers were utilizing a recently released exploit module to distribute a cryptocurrency (or “coin”) miner, dubbed “BlueKeep Monero Miner” which is detected by 44% of scanners on VirusTotal as of November 3. Beaumont shared his insights in a blog post as well.
Though it took several months for the first in-the-wild exploit of BlueKeep to be seen, the expectation has always been there. Back in July, a cryptocurrency mining botnet known as WatchBog incorporated a BlueKeep scanning module to identify vulnerable systems. In August, there was chatter that a BlueKeep exploit would be incorporated into open-source tools.
While this in-the-wild exploit isn’t a WannaCry-level event, it serves as a cautionary reminder that organizations with vulnerable systems should prioritize patching them immediately.
解决方案
Tenable recommends applying patches immediately. The following table contains the relevant security updates and monthly rollups for various products.
| Security Update | 产品 |
|---|---|
| 4499175 (Security Only) 4499164 (Monthly Rollup) |
|
| 4499180 (Security Only) 4499149 (Monthly Rollup) |
|
| 4499180 (Security Update) |
|
| 4500331 (Security Update) |
|
In addition to patching, Tenable recommends the following mitigation steps:
- Enable Network Level Authentication (NLA). Microsoft recommends NLA as a mitigation, however, NLA may be something an organization chooses to deploy in addition to patching.
- Block RDP (Default is TCP port 3389) at your perimeter firewall.
- Disable any unused services.
- Upgrade end-of-life (EOL) operating systems. As a reminder, Windows 7 goes EOL on January 14, 2020.
识别受影响的系统
Tenable released a remote check plugin for CVE-2019-0708 after Microsoft disclosed the vulnerability. This plugin can identify affected systems without providing credentials.
To identify systems that do not have NLA enabled, please use plugin 58453.
A list of all plugins to identify BlueKeep (CVE-2019-0708) are available here.
获取更多信息
- Marcus Hutchins’ Blog on BlueKeep Exploited in the Wild (KryptosLogic)
- Kevin Beaumont's blog on BlueKeep Exploited in the Wild
- Microsoft Blog Announcing Fix for CVE-2019-0708
- Microsoft Customer Guidance for CVE-2019-0708
加入 Tenable Community 中的 Tenable 安全响应团队
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
相关文章
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
- Vulnerability Management