When Patching is not Sufficient

No doubt that patching is part of our priority list. But patching isn't sufficient in some cases, such as the ProxyLogon case.

Microsoft claims that 92% of Exchange servers have applied the mitigations against the critical flaw. However, it is critical to investigate Exchange servers in detail while patching. A pre-patch compromise is very likely.

Here're the 2 tools to help detect the IOC and you can cross check with your SIEM.

1. CHIRP IOC Detection Tool (CISA)
2. Microsoft Defender
   

Links:

• https://www.zdnet.com/article/microsoft-92-of-vulnerable-exchange-servers-are-now-patched-mitigated/

What we can Learn from SolarWind Incident?

Lesson learned from SolarWind incident:

1. Your risk boundary is not your network boundary.
   
2. An attack timeline, from start till release date, can take almost 19 months.
3. Identity is the new "perimeter".
4. Behavioral analysis techniques are required to identify an identity compromise.
5. Network baselining and abnormal behavior analytics are instructive.
   
6. Think if you built software using third party library.
   
7. Think if you are using products/services from any compromised parties, including open source software. 
8. Think who you trust and when did you last validate?
9. Build capability to detects TTP, not IOC.
   
10. CTI likes to use different code name to identify malware.
    

0-day Attack on Exchange Server (By HAFNIUM)

Your organization should have in incident response mode now if there is any OWA server exposed to the Internet between 02/26 ~ 03/03.

Microsoft has detected multiple zero-day exploits being used to attack on-premises Exchange server, and allowed installation of web shell to facilitate long-term access at vulnerable servers.

Vulnerabilities Summary 

CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

Remediation

Microsoft has provided scripts to check the patch level at Exchange server, and scan the Exchange logs for indication of compromise.

Links:

• https://arstechnica.com/gadgets/2021/03/tens-of-thousands-of-us-organizations-hit-in-ongoing-microsoft-exchange-hack/
  
• https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
• https://github.com/microsoft/CSS-Exchange
  

What is IoC?

IoC stands for Indicator of compromise.

Indicator of compromise (IoC) in computer forensics is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.

Links:

• https://en.wikipedia.org/wiki/Indicator_of_compromise
  
• https://azeria-labs.com/iocs-vs-ttps/