BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Flame Burns a Little Brighter

Posted June 4, 2012    BeyondTrust Research Team

Did you know that Microsoft’s Terminal Server Licensing Service (we’ll call it TSLS for convenience) generated certificates that could be used to sign code? No? Neither did Redmond. Flame leveraged a “0day” (zero day) within TSLS to sign its own code, allowing it to appear as if the code came from Microsoft. This allowed Flame to propagate itself in a network by fooling other machines into believing it was serving Windows Update packages, when in actuality, it was serving up Microsoft signed versions of Flame. More details follow… but first, here is some actionable intelligence:

What does this mean for you and your organization? Apply this fix (Bulletin, Patch) immediately. Unless the patch is applied, your machines may end up trusting malicious code. Retina provides detection for the vulnerable certificates via audit 16497 – Microsoft Revocation of Fraudulent Certificates (2718704).

What does this mean for Flame? It is the first confirmed 0day used by Flame. Albeit, this 0day does not grant an attacker the ability to remotely control a machine with the use of a malformed packet or PDF. However, the use of this vulnerability shows sophistication and access to undisclosed exploitable bugs that may hint at the overall cleverness of Flame. Flame has moved beyond the realm of exploiting known flaws, to the fertile lands of 0day.

So how did this all go down? Well that is a very interesting, yet brief, tale. It all starts with an infected machine on a network. We’ll call that infected box… “Machine A”. Machine A is infected and is looking for opportunities to infect other machines on its network. It sets up a server by the name of “MSHOME-F3BE293C” and starts listening to WPAD requests sent by machines set to automatically configure its proxy settings (Internet Properties –>Connections –>LAN Settings–>Automatically detect settings).

By listening and replying to WPAD requests, the infected machine can point other machines to its proxy configuration file (PAC); effectively, an attacker can then dictate that traffic pass through the infected machine. Once it falsely declares itself as the proxy for the domain, other unwitting (and currently uninfected) machines start routing traffic through Machine A. When Machine A eventually sees some Windows Update queries come across its desk, it replies with a fake update that proceeds to download Flame and *BLAM*, the infection spreads.

By leveraging WPAD weaknesses (which are no stranger to WPAD, see http://technet.microsoft.com/en-us/security/advisory/945713) and Microsoft signed executables, Flame was able to redirect traffic and then subsequently push malicious code onto target machines without any warnings or prompts, because MS code is to be trusted implicitly… Flame may potentially be more sophisticated and refined than its massive size may lead some to believe. Granted, Flame is still being analyzed, and from all estimates there is a long way to go, so stay tuned.

Tags:
, , ,

Leave a Reply

Additional articles

webinar 2

On Demand Webinar: Because Auditing Stinks Sometimes

Posted July 2, 2015    Lindsay Marsh

Auditing stinks. Well, mostly stinks. In this on demand webinar, lead by Group Policy MVP Jeremy Moskowitz, you’ll learn the three key tenets to real Group Policy auditing. Tenet 1: Why do you care about Group Policy auditing? Tenet 2: How does Eventing help you know “Who did what?” Tenet 3: How does Reporting tell…

Tags:
, , , ,
skeletonkey3_713678_713680

Stopping the Skeleton Key Trojan

Posted June 29, 2015    Robert Auch

Earlier this year Dell’s SecureWorks published an analysis of a malware they named “Skeleton Key”. This malware bypasses authentication for Active Directory users who have single-factor (password only) authentication. The “Skeleton Key” attack as documented by the SecureWorks CTU relies on several critical parts.

Tags:
, , , , ,
webinar 2

On Demand Webinar: 10 Steps to Building an Effective Vulnerability Management Program

Posted June 26, 2015    BeyondTrust Software

In this on demand webinar, Cybersecurity Expert, Derek A.Smith will take you through his 10 steps for a successful vulnerability management program and how to get started now.

Tags:
, ,