The US Feds have cleared malicious web shells from 100s of vulnerable computers in the US that had been compromised via the now-infamous Proxy Logon Microsoft Exchange vulnerabilities.
In a virtual ‘cyber-SWAT’ type action, the FBI remotely removed the infections without warning businesses 1st.
Security Bugs
Proxy Logon comprises a group of security bugs affecting on-premises versions of Microsoft Exchange Server software for email. Microsoft last month warned that the bugs were being actively exploited by the Hafnium advanced persistent threat (APT); after that, other researchers said that 10 or more additional APTs were also using them.
Proxy Logon consists of 4 flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) that can be chained together to create a pre-authentication remote code execution (RCE) exploit – meaning that attackers can take over servers without knowing any valid account credentials.
This gives them access to email communications & the opportunity to install a web shell for further exploitation within the environment, such as the deployment of ransomware.
Already Compromised
While patching levels have accelerated, this will not help already-compromised computers.
“Many infected system owners successfully removed the web shells from 1,000s of computers,” explained the Department of Justice, in a Tues. announcement. “Others appeared unable to do so, & 100s of such web shells persisted unmitigated.”
The situation prompted the FBI to move; in a court-authorised action, it issued a series of commands through the web shells to the affected servers. The commands were designed to cause the server to delete only the web shells (identified by their unique file path).
Notify Beforehand
It did not notify affected organisations beforehand, but authorities said that they are sending out notices now.
“Today’s court-authorised removal of the malicious web shells demonstrates the Department’s commitment to disrupt hacking activity using all of our legal tools, not just prosecutions,” stated US Assistant Attorney General John Demers for the DoJ’s National Security Division, in the release.
Unilateral FBI Action
Further technical details of the action are being kept confidential, however Erkang Zheng, Founder & CEO at Jupiter One, noted that the action is ‘unprecedented.’
“What makes this really interesting is the court ordered remote remediation of vulnerable systems,” he observed. “This is the 1st time that this has happened and with this as a precedent, it likely won’t be the last. Many enterprises today have no idea what their infrastructure & security state looks like – visibility is a huge problem for CISOs.”
Dirk Schrader, Global VP of Security Research at New Net Technologies, noted that the FBI’s lack of transparency could be problematic.
Critical Issues
“There are a few critical issues in this,” he explained. “One is the FBI stating the action was because these victims lack the technical ability to clear their infrastructure themselves, another is that it seems the FBI intends to delay informing the victims about the removal itself by at least a month, citing ongoing investigations as a reason.”
He explained, “This can cause other issues, as the victims have no chance to investigate what kind of information has been accessed, whether additional backdoors where installed, & a range of other concerns come with this approach.”
Monti Knode, Director of Customer & Partner Success at Horizon3.AI, noted that the action illuminates just how dangerous the bugs are.
Protected Computers
“Government action is always predicated by an authority to act,” he outlined. “By specifically calling out ‘protected computers’ & declaring them ‘damaged’, that appears to have been enough to give the FBI a signed warrant to execute such an operation without notifying victims ahead of the operation execution.
Whilst the size of the operation is not known (redacted by court order), the fact that the FBI was able to execute in under 4 days, & then publicly release this effort, shows the potential US national security risk posed by these exploited systems & the prioritised planning involved. This isn’t a knee-jerk reaction.”
Web Shells
This operation was successful in copying & removing the web shells, the FBI reported. However, organisations still need to patch if they have not yet done so.
“Combined with the private sector’s & other govt. agencies’ efforts so far, including the release of detection tools & patches, we are together showing the strength that public-private partnership brings to our country’s cyber-security,” Denmers commented.
“There’s no doubt that more work remains to be done but let there also be no doubt that the Department is committed to playing its integral & necessary role in such efforts.”
New Exchange RCE Bugs
This news comes after April Patch Tues., in which Microsoft revealed more RCE vulnerabilities in Exchange (CVE-2021-28480 through CVE-2021-28483), which were discovered & reported by the US National Security Agency (NSA). A mandate to US federal agencies to patch them by Fri. also went out.
Immersive Labs’ Kevin Breen, Director of Cyber-Threat Research, warned that weaponization of these may come faster than usual, since motivated attackers will be able to use existing concept code.
Nation-States
“This underlines the criticality of cyber-security now to entire nations, as well as the continued blurring of the lines between nation-states, intelligence services & enterprise security,” he added.
“With a number of high-profile attacks affecting well-used enterprise software recently, the NSA are obviously keen to step up & play a proactive role.”
https://www.cybernewsgroup.co.uk/virtual-conference-may-2021/
