Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

11/9/2017
10:30 AM
Shaun Donaldson
Shaun Donaldson
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Hypervisors: Now a Tool to Protect against Security Blind Spots

By facilitating live introspection of virtual machine memory, the Xen Project is striving to eliminate stealthy attack techniques like EternalBlue.

Plenty of ink has been used to discuss WannaCry, and rightfully, since ransomware itself is a significant security challenge. What has been largely missed is that WannaCry is just one attack that took advantage of EternalBlue, and that EternalBlue itself is an example of how attackers take advantage of security blind spots.

What Is EternalBlue?
On April 14, an anonymous group known as "Shadow Brokers" released 10 exploit kits. One of these kits was called EternalBlue. The group alleged that EternalBlue was originally created by the US National Security Agency (NSA).

EternalBlue gained prominence in May 2017 through a worldwide ransomware attack targeting computers running the Microsoft Windows operating system, encrypting data and demanding ransom payments in bitcoin. Like all ransomware, WannaCry is the end result of a successful attack — malware that has executed on the targeted machine. The creators of WannaCry used the EternalBlue exploit to give WannaCry the ability to propagate itself without user interaction.

Why Is EternalBlue Important?
It is not publicly known when EternalBlue was developed. Likewise, it's difficult to know how long groups, like Shadow Brokers, had EternalBlue before publicly releasing it. If you think the NSA developed EternalBlue, then you know they didn't do it to shore up their budget by distributing cryptocurrency miners. EternalBlue could have easily been used to deliver and embed quieter malware packages — say, stealthy software designed to surreptitiously find and allow exfiltration of sensitive information.

While attacks by loud malware — malware that makes its presence known — such as WannaCry gain notoriety, the goal of the most sophisticated attackers is to achieve remote access with the greatest possible stealth. In other words, WannaCry rained on the EternalBlue stealth parade. The bad news is that it is not the first, nor will it be the last private party.

But the Vulnerability Had a Patch, Right?
History has a way of repeating itself. Conficker abused MS-08-067 in 2008. SQL Slammer arrived in 2003, abusing MS02-039. The next EternalBlue will probably exploit a vulnerability that isn't yet publicly known, or for which organizations have not had time to deploy a patch.

Hopefully, all endpoint security vendors can now detect the likes of Conficker, SQL Slammer, and WannaCry. That is a good thing, but it's not enough. Detecting the results of an attack or building detection of the signs of a specific attack after the attack is necessary but does not get to the root of the problem.

If EternalBlue Is the Root of WannaCry, What Is the Root of EternalBlue?
EternalBlue exploits the SMBv1 vulnerability by using a buffer overflow. At the root, a request is sent to the SMBv1 service; the request is crafted to take advantage of the mishandling of memory to produce an unintended result (executing code included in the crafted request on the targeted system).

The code that is executed provides the attacker control by way of administrator-level privilege ("system" on Windows machines). After a successful exploit, the remote commands are run in memory — nothing needs to be written to disk. An attacker may then upload malware to the compromised system, and exfiltrate data as he wishes.

Is There a Way out of Repeating the Past?
Attacks use the same set of tools — buffer overflows, code injection, heap spray, and so on — repeatedly, and successfully, against the stack that runs operating systems, and their workloads. However, virtualization has changed the stack.

In the olden days, an operating system ran directly against hardware. Virtualization introduced the hypervisor, which acts as an interface between the operating systems and hardware. This created the opportunity to inspect — indeed, introspect — memory at a layer below the most privileged layer within guest operating systems.

The Xen Project, building on efforts from individuals and security organizations, collaborated to create Machine Introspection, an API that has been commercialized as Citrix XenServer Direct Inspect APIs. The API facilitates live introspection of virtual machine memory at the hypervisor, eliminating the need to deploy software within virtual machines. This allows for live introspection of VM memory from outside the VM, and will help eliminate some of the stealthy attack techniques like the buffer overflow EternalBlue leverages. The API is open to all security vendors to build and expand on. More information can be found here.

What Is the Bottom Line?
Malicious code doesn't arrive on a target system by mysterious means. User interaction, such as clicking on a link or accepting the installation of nefarious software, is a straightforward method of delivering an attack. On the other hand, discovering and exploiting unknown vulnerabilities long before they are recognized and patched is far more complicated and time consuming. The first succeeds by leveraging high-volume attacks, hoping that at least one user will fall for it. The second leverages intense investment in research but, like EternalBlue, does not require user interaction.

There are myriad ways of defending against widely known, high-volume attacks (user education, email and URL sanitization, etc.). Sometimes, as with WannaCry, attacks will quickly incorporate recently revealed vulnerability exploits, such as EternalBlue.

The second type of attack — identifying and exploiting unknown vulnerabilities — cannot be absolutely defeated, but by inspecting virtual machine memory at the hypervisor, plenty of attack techniques can be taken out of the attacker playbook. This raises the cost of investment in creating successful attacks, stopping things like EternalBlue from succeeding before there was such a thing as EternalBlue. 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Shaun Donaldson is director of strategic alliances at Bitdefender Enterprise. Shaun is responsible for supporting relationships with technology alliance partners, large enterprise customers, and open-source projects. Bitdefender regularly contributes to projects, including ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15037
PUBLISHED: 2020-07-07
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st[] parameter.
CVE-2019-4323
PUBLISHED: 2020-07-07
"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
CVE-2019-4324
PUBLISHED: 2020-07-07
"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
CVE-2020-15036
PUBLISHED: 2020-07-07
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.php dv parameter.
CVE-2020-15577
PUBLISHED: 2020-07-07
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Cameralyzer allows attackers to write files to the SD card. The Samsung ID is SVE-2020-16830 (July 2020).