Use NMAP to scan for MS17-010 Vulnerability

Sometimes you need to check on the status of your applied updates and quickly. With news of WannaCry, Petya, Nyetya Ransomware spreading via the MS17-010 vulnerability around the globe it’s a good idea to double check that all your updates are applied correctly. Even if you have comprehensive vulnerability management and patching programs there are almost certainly servers that have been missed, whether because they are vendor supported or part of your company's cottage IT. It is important to be able to find those servers and either remediate them or put additional controls in place to protect them.

Save it to Nmap NSE script directory:

• Linux – /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
• OSX – /opt/local/share/nmap/scripts/
• Windows ZenMap Install – C:\Program Files (x86)\Nmap\scripts

While detecting SMB is the first step, there are legitimate reasons why a server may have SMB open. For the specific case of finding servers that are vulnerable to MS17-010 we need to dig a bit deeper.

The following is a quick NMAP Execute Script monitor to check for the presence of the fixes needed to mitigate MS17-010:

Using the NSE smb-vuln-ms17-010.nse Script

If you’re using the command line version of NMap on any system, you can run this command (change the IP range to meet your needs):

nmap -sC -p 445 --script smb-vuln-ms17-010.nse 192.168.1.0/24

If you’re using the Windows ZenMap GUI, fill in the Target box with your IP (or IP range) and use this line in the Command box (it should automatically append the IP/Range to the end of this command):

nmap -sC -p 445 --script smb-vuln-ms17-010.nse

Scan Results

When the scan finds a server with SMB open and not vulnerable to MS17-010 then the output looks identical to the previous scan however a vulnerable server will generate additional output.

Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-17 13:18 Central Daylight Time

Nmap scan report for 192.168.1.50

Host is up (0.014s latency).

PORT STATE SERVICE

445/tcp open microsoft-ds

Host script results:

| smb-vuln-ms17-010:

| VULNERABLE:

| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)

| State: VULNERABLE

| IDs: CVE:CVE-2017-0143

| Risk factor: HIGH

| A critical remote code execution vulnerability exists in Microsoft SMBv1

| servers (ms17-010).

|

| Disclosure date: 2017-03-14

| References:

| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143

| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

|_ https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Nmap done: 1 IP address (1 host up) scanned in 0.98 seconds

What to do next

If you find a vulnerable machine, you’ll want to patch it right away. You can use the following references to find information for your Operating System version:

• Microsoft MS17-010 Security Bulletin
• Microsoft TechNet – Customer Guidance For WannaCrypt Attacks

As a general rule, don’t rely on this NMap script to find all of your vulnerable systems, this is only a tool. Stay current on patching workstations and servers.

Now your Windows Defender Antivirus helps you to prevent ransomware attack. Let us see how!

After WannaCry and Petya, it seems like Microsoft has realized the potential harm that ransomware can cause to its operating systems and its customers' sensitive information. Microsoft is making some interesting security-related changes to Windows 10 with the next Fall Creators Update, expected to debut in September. Windows 10 testers can now access a preview of the changes that include a new controlled folder access feature. It’s designed to only allow specific apps to access and read / write to a folder.

Windows Defender Antivirus is your default security software on Windows 10 to protect your system against viruses, spyware, rootkits, and other types of malware out-of-the-box, including ransomware. Starting with Windows 10 build 16232, Controlled folder access is introduced in Windows Defender Antivirus, to make it easier to protect your data from malicious programs and threats like ransomware. 

This new feature essentially monitors the changes that apps make to files in certain folders that are protected. If an app is blacklisted and tries to make changes to files in the protected folders, the user will get a notification about the attempt. Certain applications will be white-listed automatically, though the company doesn't specify which applications. To allow certain apps through the feature, users need to click Allow an app through Controlled folder access and locate and add the app. Think of it as a layer of protection against manipulation of files that are stored in protected folders.

Controlled Folder Access is not enabled by default. First thing you need to do is enable the feature by flipping its preference to on, and adding at least one folder that you want the feature to protect on the device. You can add additional folders to the list of protected folders, but you cannot alter the default list, which includes folders such as Documents, Pictures, Movies, and Desktop. Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults.

You must be signed in as an administrator to change Controlled folder access settings.

Option 1: To Turn On or Off  Windows Defender Controlled Folder Access

Note: Turning on or off Controlled folder access will modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exploit Guard\Controlled Folder Access

GuardMyFolders DWORD

0 = Off               1 = On

1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon.
2. Click/tap on the Virus & threat protection settings link.
3. Turn On or Off (default) Controlled folder access for what you want.
4. Click/tap on Yes when prompted by UAC to approve.
5. When finished, you can close Windows Defender Security Center if you like.

Option 2: To Add or Remove Protected Folders for Windows Defender Controlled Folder Access

Note: The list of added protected folders is stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exploit Guard\Controlled Folder Access\GuardedFolders

1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon. 
2. Click/tap on the Virus & threat protection settings link. 
   
3. Click/tap on the Protected folders link under Controlled folder access.
4. Do step 5 (add) or step 6 (remove) below for what you would like to do.
5. To add a protected folder.
6. Click/tap on the Add a protected folder + button.
7. Navigate to and select the folder (ex: "Documents") you want to add, click/tap on Select Folder, and go to step 10 below.
8. To remove a protected folder.
9. Click/tap on a listed folder (ex: "Documents") you want to remove, click/tap on the Remove button, and go to step 10 below. 
10. Click/tap on Yes when prompted by UAC to approve.
11. When finished, you can close Windows Defender Security Center if you like.

Option 3: To Add or Remove Allowed Apps through Windows Defender Controlled Folder Access

Note: The list of allowed apps is stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exploit Guard\Controlled Folder Access\AllowedApplications

1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon. 
2. Click/tap on the Virus & threat protection settings link.
3. Click/tap on the Allow an app through Controlled folder access link under Controlled folder access.
4. Do step 5 (add) or step 6 (remove) below for what you would like to do.
5. To add a allowed app
6. Click/tap on the Add an allowed app + button.
7. Navigate to and select the folder (ex: "notepad.exe") you want to allow, click/tap on Open, and go to step 10 below.
8. To remove a allowed app
9. Click/tap on a listed folder (ex: "notepad.exe") you want to remove, click/tap on the Remove button, and go to step 10 below. 
10. Click/tap on Yes when prompted by UAC to approve.
11. When finished, you can close Windows Defender Security Center if you like.

That's it!

SOREBRECT Ransomware: Fileless Malware Detected In The Wild

Attackers are constantly looking for new ways to evade detection. While new forms of cybercrime are on the rise, traditional activities seem to be shifting towards more illegitimate techniques that come with limitless attack vectors with low detection rates. New malware techniques take advantage of operating system features to inject malicious code into memory or the operating system registry without leaving a file on the disk.

Security researches firstly encountered SOREBRECT during their monitoring in this early year, affecting the systems and networks of organizations in the Middle East. Extracting and analysing the SOREBRECT samples revealed the unusual techniques it employs to encrypt its victim’s data. Unlike traditional ransomware, SOREBRECT has been designed to target enterprise's servers and endpoint. These attacks are known as fileless or non-malware ransomware and it leverages Microsoft’s PowerShell’s scripting language to target organizations through documents and/or applications that run through macros.

The experts noticed that the SOREBRECT fileless ransomware first compromises administrator credentials (i.e. by brute forcing attacks), then leverage Microsoft Sysinternals PsExec command-line utility to encrypt files. PsExec can enable attackers to run remotely executed commands, instead of providing and using an entire interactive login session, or manually transferring the malware into a remote machine, like in RDPs.

SOREBRECT takes this a notch further by maliciously deploying PsExec and performing code injection. It injects its code into Windows’ svchost.exe process, while the main binary self-destructs. The combination is potent: once the deployed ransomware binary finishes execution and self-termination, the injected svchost.exe—a legitimate Windows service-hosting system process—resumes the execution of the payload (file encryption). Because SOREBRECT becomes fileless after code injection, sourcing its binary sample at the endpoint level is challenging.

SOREBRECT can also scramble the files of other computers connected to the infected machine through the local network. It does so by scanning the network for asset discovery and enumerating open shares—folders, content or peripherals (i.e. printers) that others can readily access through the network.

How does Fileless Ransomware Work with PowerShell?

Non-malware aka fileless ransomware (unlike traditional ransomware) does not use files to encrypt your data; instead it writes scripts/macros which derive from PowerShell to encrypt the files.

What are the two ways fileless ransomware can penetrate your systems?

Via Phishing Attacks: An email is opened on a device and automatically writes macros directly to your device’s (i.e. tablet, laptop, cellphone or desktop) memory which starts dictating commands of payment as well as encrypting your data.

Via Compromised Websites: An employee browses or visits a compromised/malicious website in which the cyber criminals write scripts to the computer’s RAM to capture some pertinent information which will then either ask for cryptocurrency or immediately encrypt your files.

Why is fileless ransomware unique?

Fileless malware is unique and difficult to detect because the malicious code is embedded into a native scripting language or written straight into the computer’s RAM, where it hides in isolated spots within the computer’s memory. It’s not written to disk nor does the malicious code rely on the hard drive to run these commands.

What are the problems associated with Fileless Ransomware?

• Fileless ransomware leaves little trace behind nor can it be detected with any antivirus software.
• This ransomware strain allows cyber criminals to have access to your systems, meaning that they can infiltrate your computers, steal your information and encrypt your files without your IT staff even knowing. 
• It can lead to more attacks. As the cyber criminals are writing scripts they’re also gathering as much data from the victim’s computer as possible.

What can end users do to protect themselves?

Since the ransomware does not target individuals but organizations, sysadmins and information security professionals can protect themselves by:

1. BACKUP YOUR DATA
2. BLOCK ALL INFECTED EMAILS, PAGES & COMMUNICATION WITH BROWSERS AND SERVERS.
3. UPDATE YOUR SYSTEM
4. RESTRICT USER WRITE PERMISSIONS
5. BE VIGILANT
6. FOSTER A CYBER SECURITY AWARENESS SESSIONS

Humans are often the weakest defensive link, and this type of attack relies heavily on that vulnerability.

Millions Are Lost Cause Of Poor Endpoint Security

With more than 200 different products from 125 vendors to solve the top 20 security controls (deep breath), there’s no shortage of information security tools in the market. Organizations are building defensive arsenals with these tools, but the intruders are still slipping through the digital “doors and windows” left open and unlocked by the organization.

Why predict the next threat when you can confidently address the root cause of the problem? First, identify what needs to be managed and secured within an environment, then work to proactively secure every asset with the appropriate patches and security configuration controls. It’s the first thing we say to our customers: you can’t secure what you can’t manage, and you can’t manage what you don’t know about.

A new study reveals organizations are wasting an average of $6 million on the time to detect and contain insecure endpoints, among other staggering findings that show endpoint threats are a growing concern, companies are not efficiently protecting their proprietary data, and the cost and complexity of reducing endpoint risks are at an all-time high.

The research did not take into account the liability associated with increased risks of data breaches that are becoming all too commonplace as workers place data at risk on laptops, mobile phones and tablets.

Key findings from the study include the following:

• 56% of companies lack a cohesive compliance strategy,
• 70% report a “below average” ability to minimize endpoint failure damages.
• 28 percent of respondents say their organizations rely upon automated analysis and inspection to determine compliance.
• 63% could not monitor endpoint devices when they left the corporate network
• 53% of companies reveal that malware infected endpoints have increased in the last 12 months.
• Respondents believe automation increases efficiency and offers better visibility of dark endpoints: It costs organizations an average of $1.37 million annually in wasted time responding to erroneous malware alerts. Enterprises could save nearly $2.1 million annually with automated endpoint security solutions.

This study along with recent ransomware attacks and high-profile data breaches show the danger of today’s endpoint blind spots, and underscore that automation and newer approaches to endpoint security are key to safeguarding endpoints and the sensitive data on them for optimal business performance.

All in all, we found:

Adobe: 2,771 critical vulnerabilities (CVSS 5 or higher) with 98.9% of endpoints running vulnerable version of Shockwave. 91% had vulnerable versions of Flash.

Java: 106 distinct versions of Java detected with 97.8% of endpoints impacted by vulnerabilities.

Windows Patches: 77% of machines were missing six or more critical updates, with 1.6 million missing patches in all and 2007 being the oldest reported missing critical patch — a nearly 10 year old missing critical patch.

SCCM: 20% of machines with unhealthy SCCM clients.

After an Assessment, the end of the story isn’t just fixing your patches and closing your vulnerabilities. An assessment report is simply a snapshot of today. If it’s the end of your actions, you’ll find yourself in the exact same position soon enough if your tools and workflows aren’t corrected. Therefore, it is necessary to establish a process and measure the effectiveness for continual improvement.

Don’t waste time guessing where the next attack might occur, when you can fix the underlying problems.

National Critical Information Infrastructure Protection Centre (NCIIPC)

In the recent times, there is an increasing stress upon cyber security at the international level. This is so because cyber-attacks are happening at the international level and all the countries are facing this threat. Countries are trying to coordinate cyber security initiatives at national and international levels. However, cyber security in India is still not up to the mark. India is increasingly facing cyber-attacks and cyber threats from foreign nationals.

For instance, cyber terrorism against India, cyber warfare against India, cyber espionage against India and cyber-attacks against India have increased a lot. Previously, we did not have a strong cyber law to deter cyber-attacks and cyber-crimes. Further, we had no cyber security laws in India as well.

In the verge of finding a strong solution to this, a national critical information infrastructure protection centre (NCIIPC) of India was been proposed & brought into existence. It intends to ensure critical infrastructure protection and critical ICT infrastructure protection in India.

Ministry of communication and information technology (MCIT) has already taken certain initiatives in this regard. For instance, a central monitoring system (CMS) project of India has been launched by MCIT to monitor and intercept electronic communications, messages and information. Further, a national telecom network security coordination board (NTNSCB) of India has also been proposed to strengthen the national telecom security of India.

Similarly, the home ministry of India has also launched national intelligence grid (Natgrid) project of India, crime and criminal tracking networks and systems (CCTNS) project of India, national counter terrorism centre (NCTC) of India, etc. These projects intend to strengthen the intelligence gathering and counter terrorism capabilities of India.

The cyber law of India must be suitably amended, perhaps repealed, to make a more robust and stringent cyber law of India. We need dedicated cyber security legal framework in India and cyber forensics laws in India.

What is NCIIPC?

National Critical Information Infrastructure Protection Centre (NCIIPC) is an organisation of the Government of India created through a gazette notification based in New Delhi, India, it is designated as the National Nodal Agency in respect of Critical Information Infrastructure Protection.

NCIIPC has broadly identified many critical sectors, few of them are as follows: 

• Power & Energy
• Banking, Financial Institutions & Insurance
• Information and Communication Technology
• Transportation
• Government (except those under the Ministry of Defence)
• Strategic Public Enterprises
• States and Union Territories

What NCIIPC does?

It takes all necessary measures to facilitate protection of Critical Information Infrastructure from unauthorized access, modification, use, disclosure, disruption, incapacitation or distraction through coherent coordination, synergy and raising information security awareness among all stakeholders. 

Operations of NCIIPC:

• They protect and deliver advice that aims to reduce the vulnerabilities of critical information infrastructure, against cyber terrorism, cyber warfare and other threats.
• They identify all critical information infrastructure elements for approval by the appropriate Government for notifying the same.
• They coordinate, share, monitor, collect, analyse and forecast, national level threat to CII for policy guidance, expertise sharing and situational awareness for early warning or alerts.
• They evolve protection strategies, policies, vulnerability assessment and auditing methodologies and plans for their dissemination and implementation for protection of Critical Information Infrastructure.
• They develop/organise training and awareness programs as also nurturing and development of audit and certification agencies for protection of Critical Information Infrastructure.
• They issue guidelines, advisories and vulnerability or audit notes etc. relating to protection of critical information infrastructure and practices, procedures, prevention and response in consultation with the stake holders, in close coordination with Indian Computer Emergency Response Team and other organisations working in the field or related fields.
• In the event of any threat to critical information infrastructure the National Critical Information Infrastructure Protection Centre may call for information and give directions to the critical sectors or persons serving or having a critical impact on Critical Information Infrastructure.
• Undertaking research and development and allied activities, providing funding (including grants-in-aid) for creating, collaborating and development of innovative future technology for developing and enabling the growth of skills, working closely with wider public sector industries, academia and with international partners for protection of Critical Information Infrastructure.

NCIIPC has also been instrumental in declaring two major entities as protected – systems of the Aadhar unique identification project and the Long Range Identification and Tracking (LRIT) system of the Ministry of Shipping. The agency has also started approaching various sectors to create guidelines that can set standards for private and public sector entities across the board.

Would like to add that with the establishment of the National Critical Information Infrastructure Protection Centre (NCIIPC) in 2014, India has taken an important measure towards strengthening its cybersecurity which maintains a 24x7 Help Desk to facilitate reporting of incidents. It plays a crucial role to coordinate the response of the various CII stake-holders in close cooperation with CERT-India.