CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner
Researchers identify the first in-the-wild exploit of the BlueKeep vulnerability nearly six months after it was disclosed.
Background
On November 2, security researchers Kevin Beaumont (@GossiTheDog) and Marcus Hutchins (@MalwareTechBlog) confirmed the first in-the-wild exploitation of CVE-2019-0708, also known as BlueKeep.
Analisi
CVE-2019-0708, a critical remote code execution vulnerability in Microsoft’s Remote Desktop Services, was patched back in May 2019. The vulnerability raised eyebrows, particularly because Microsoft released security updates for out-of-support versions of Windows, in an effort to thwart a potential worm that could spread just as WannaCry did in 2017. Beaumont is credited with naming the vulnerability “BlueKeep,” inspired by Game of Thrones. He subsequently set up BlueKeep honeypots to keep tabs on global attempts to exploit the flaw in-the-wild.
CVE-2019-0708 RDP vulnerability megathread, aka BlueKeep.
— Kevin Beaumont (@GossiTheDog) May 14, 2019
Going to nickname it BlueKeep as it’s about as secure as the Red Keep in Game of Thrones, and often leads to a blue screen of death when exploited.
This weekend, Beaumont observed blue screens of death (BSODs) for his BlueKeep honeypots starting on November 2.
huh, the EternalPot RDP honeypots have all started BSOD'ing recently. They only expose port 3389. pic.twitter.com/VdiKoqAwkr
— Kevin Beaumont (@GossiTheDog) November 2, 2019
Beaumont shared a kernel crash dump from his honeypots with Hutchins, who confirmed this as the first exploitation of BlueKeep in the wild.
Blog post on how I discovered mass exploitation of BlueKeep from a kernel dump of a crashed system. https://t.co/2tLdLNosYt
— MalwareTech (@MalwareTechBlog) November 3, 2019
Hutchins shared his analysis in a blog post, where he identified the attackers were utilizing a recently released exploit module to distribute a cryptocurrency (or “coin”) miner, dubbed “BlueKeep Monero Miner” which is detected by 44% of scanners on VirusTotal as of November 3. Beaumont shared his insights in a blog post as well.
Though it took several months for the first in-the-wild exploit of BlueKeep to be seen, the expectation has always been there. Back in July, a cryptocurrency mining botnet known as WatchBog incorporated a BlueKeep scanning module to identify vulnerable systems. In August, there was chatter that a BlueKeep exploit would be incorporated into open-source tools.
While this in-the-wild exploit isn’t a WannaCry-level event, it serves as a cautionary reminder that organizations with vulnerable systems should prioritize patching them immediately.
Solution
Tenable recommends applying patches immediately. The following table contains the relevant security updates and monthly rollups for various products.
| Security Update | Prodotti |
|---|---|
| 4499175 (Security Only) 4499164 (Monthly Rollup) |
|
| 4499180 (Security Only) 4499149 (Monthly Rollup) |
|
| 4499180 (Security Update) |
|
| 4500331 (Security Update) |
|
In addition to patching, Tenable recommends the following mitigation steps:
- Enable Network Level Authentication (NLA). Microsoft recommends NLA as a mitigation, however, NLA may be something an organization chooses to deploy in addition to patching.
- Block RDP (Default is TCP port 3389) at your perimeter firewall.
- Disable any unused services.
- Upgrade end-of-life (EOL) operating systems. As a reminder, Windows 7 goes EOL on January 14, 2020.
Identifying affected systems
Tenable released a remote check plugin for CVE-2019-0708 after Microsoft disclosed the vulnerability. This plugin can identify affected systems without providing credentials.
To identify systems that do not have NLA enabled, please use plugin 58453.
A list of all plugins to identify BlueKeep (CVE-2019-0708) are available here.
Get more information
- Marcus Hutchins’ Blog on BlueKeep Exploited in the Wild (KryptosLogic)
- Kevin Beaumont's blog on BlueKeep Exploited in the Wild
- Microsoft Blog Announcing Fix for CVE-2019-0708
- Microsoft Customer Guidance for CVE-2019-0708
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Articoli correlati
CVE-2024-5806: Progress MOVEit Transfer Authentication Bypass Vulnerability
June 25, 2024Progress Software has patched a high severity authentication bypass in the MOVEit managed file transfer (MFT) solution. As MOVEit has been a popular target for ransomware gangs and other threat actors, we strongly recommend prioritizing patching of this vulnerability.
CVE-2024-28995: SolarWinds Serv-U Path/Directory Traversal Vulnerability Exploited in the Wild
June 21, 2024Following the publication of proof-of-concept exploit details for a high-severity flaw in SolarWinds Serv-U, researchers have observed both automated and manual in-the-wild exploitation attempts; patching is strongly advised.
Cybersecurity Snapshot: FTC Believes TikTok Broke U.S. Law, Asks Justice Dept. To Intervene, while French Cyber Agency Warns About Nobelium / Midnight Blizzard
June 21, 2024TikTok’s legal troubles in the U.S. could get thornier after the FTC refers complaint to the DOJ. Meanwhile, France says Russia-backed Nobelium / Midnight Blizzard is a major cyber espionage threat to European governments. Plus, check out a Tenable poll about dealing with vulnerabilities without patches. And did LockBit 3.0 make a comeback in May? Maybe – or maybe not. And much more!
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
July 5, 2024With growing concern over the recently disclosed regreSSHion vulnerability, we’re explaining here what it is, why it’s so significant, what it could mean for your cloud environment and how Tenable Cloud Security can help.
Cybersecurity Snapshot: Malicious Versions of Cobalt Strike Taken Down, While Microsoft Notifies More Orgs About Midnight Blizzard Email Breach
July 5, 2024Check out the results of a multinational operation against illegal instances of Cobalt Strike. Plus, more organizations are learning that Midnight Blizzard accessed their email exchanges with Microsoft. Meanwhile, Carnegie Mellon has a new report about how to fix and mitigate API vulnerabilities. And two new reports shed light on cyber insurance trends. And much more!
Cybersecurity Snapshot: Memory Bugs Pervasive in Open Source SW, While Car Dealership Chaos Persists After Ransomware Attack
June 28, 2024Check out why memory vulnerabilities are widespread in open source projects. Plus, get the latest on the ransomware attack that’s disrupted car sales in North America. In addition, find out why a majority of organizations grew their cyber budgets this year. And learn how confidential data from U.S. chemical facilities may have been accessed by hackers. And much more!
- Vulnerability Management