BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Flame Burns a Little Brighter

Posted June 4, 2012    BeyondTrust Research Team

Did you know that Microsoft’s Terminal Server Licensing Service (we’ll call it TSLS for convenience) generated certificates that could be used to sign code? No? Neither did Redmond. Flame leveraged a “0day” (zero day) within TSLS to sign its own code, allowing it to appear as if the code came from Microsoft. This allowed Flame to propagate itself in a network by fooling other machines into believing it was serving Windows Update packages, when in actuality, it was serving up Microsoft signed versions of Flame. More details follow… but first, here is some actionable intelligence:

What does this mean for you and your organization? Apply this fix (Bulletin, Patch) immediately. Unless the patch is applied, your machines may end up trusting malicious code. Retina provides detection for the vulnerable certificates via audit 16497 – Microsoft Revocation of Fraudulent Certificates (2718704).

What does this mean for Flame? It is the first confirmed 0day used by Flame. Albeit, this 0day does not grant an attacker the ability to remotely control a machine with the use of a malformed packet or PDF. However, the use of this vulnerability shows sophistication and access to undisclosed exploitable bugs that may hint at the overall cleverness of Flame. Flame has moved beyond the realm of exploiting known flaws, to the fertile lands of 0day.

So how did this all go down? Well that is a very interesting, yet brief, tale. It all starts with an infected machine on a network. We’ll call that infected box… “Machine A”. Machine A is infected and is looking for opportunities to infect other machines on its network. It sets up a server by the name of “MSHOME-F3BE293C” and starts listening to WPAD requests sent by machines set to automatically configure its proxy settings (Internet Properties –>Connections –>LAN Settings–>Automatically detect settings).

By listening and replying to WPAD requests, the infected machine can point other machines to its proxy configuration file (PAC); effectively, an attacker can then dictate that traffic pass through the infected machine. Once it falsely declares itself as the proxy for the domain, other unwitting (and currently uninfected) machines start routing traffic through Machine A. When Machine A eventually sees some Windows Update queries come across its desk, it replies with a fake update that proceeds to download Flame and *BLAM*, the infection spreads.

By leveraging WPAD weaknesses (which are no stranger to WPAD, see http://technet.microsoft.com/en-us/security/advisory/945713) and Microsoft signed executables, Flame was able to redirect traffic and then subsequently push malicious code onto target machines without any warnings or prompts, because MS code is to be trusted implicitly… Flame may potentially be more sophisticated and refined than its massive size may lead some to believe. Granted, Flame is still being analyzed, and from all estimates there is a long way to go, so stay tuned.

Tags:
, , ,

Leave a Reply

Additional articles

pbps-blog2

10 Ways to Ensure Your Privileged Password Management Strategy Will Succeed

Posted April 27, 2015    Scott Lang

Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organisation. But if passwords are such a no-brainer, why do so many data breaches tie back to poor password management?

Tags:
, , , , , , , ,
beyond-trust

PowerBroker for Windows – Most Innovative IAM Solution by Cyber Defense Magazine

Posted April 21, 2015    Scott Lang

PowerBroker for Windows has been selected as a winner by the 2015 Cyber Defense Magazine Awards Program in the category of “Most Innovative Identity and Access Management Solution”.

Tags:
, , ,
pbps-customer-campaign-image

Are you changing your passwords as often as the weather changes?

Posted April 20, 2015    Scott Lang

There is one thing that should change more frequently than the weather: Your privileged passwords. Why? If you’re like more than 25% of companies out there, then your current IT environment contains unmanaged accounts putting you at risk of data breaches and compliance violations, and you don’t have a process to control those accounts.

Tags:
, , , ,