Tuesday, March 19, 2024

Beware of the New Critical Zerologon Vulnerability in The Windows Server

Microsoft Patchs the new critical vulnerability in Zerologon, A feature of Netlogon allows the domain controller to authenticate computers and update passwords in the Active Directory.

“The elevation of privilege vulnerability for Zerologon, or CVE-2020-147, exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). “

“An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.” Microsoft’s Security Update stated.

This feature is particularly vulnerable to this flaw because it allows hackers to impersonate any computer in the company’s network and change the password, even if you have two fac tor authentication.

Through doing this, the hackers are able to change the domain controller’s password, gaining administrative access, and taking control of the network.

The Zerologon Patch

When this flaw was discovered by Secura researchers. Microsoft immediately rolled out a patch as Part I of their phased rollout. This phased rollout is scheduled to be completed during the first few months of 2021.

Microsoft has chosen to release the patch updates in a phased rollout, as changing protocols can result in major disruptions on networks and servers that aren’t updated.

The versions of Windows Server that the patches are available for are ones that still receive security updates from Microsoft. However, the temporary issue arises that many networks use non-Windows devices or have legacy Windows devices that use the protocol to communicate with domain controllers.

The Zerologon patch released in August is currently blocking any attacks, and protocols are in place that non-compliant clients can continue to communicate with domain controllers, avoiding disruptions.

The DHS Emergency Directive

The Department of Homeland Security has issued, on September 14, 2020, emergency directives for any federal agencies using the Windows Server to perform patching actions as a response to the high-risk information security threats. 

The Cybersecurity and Infrastructure Security Agency sent this warning to prevent a compromise of agency information systems. Any servers that were unable to update their domain controllers by the deadline on September 21, 2020, were directed to unplug from the networks.

Protecting Your Organization

The first thing you should do is work with your IT department to ensure the patch from Microsoft is implemented on your network immediately if it hasn’t been done so already. August’s patch from Microsoft added five Event IDs for vulnerable Netlogon connections. When a secure channel connection during the initial deployment phase is allowed, event ID 5829 is generated.

To detect the Zerologon vulnerability, look for Event ID 4742, specifically “ANONYMOUS LOGON” users, and check the Password Last Set field for any changes. Your IT department will also be able to look for activity of all domain controllers in the Active Directory with this code:

norm_id=WinServer label=Computer label=Account label=Change computer=* user=”ANONYMOUS LOGON” user_id=”S-1-5-7″ password_last_set_ts=*

Admins have the ability to monitor for Event IDs 5827 an 5828. These are triggered when Netlogon connections are denied. Event IDs 5830 and 5831 are triggered when the Group Policy allows patched domain controllers from Netlogon connections.

It’s recommended that this situation continues to be monitored, as this patch and any issues that arise from it are ongoing. At the time of publication, Microsoft has not identified any mitigating factors or workarounds for this vulnerability aside from the Zerologon patch.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Website

Latest articles

E-Root Admin Sentenced to 42 Months in Prison for Selling 350,000 Credentials

Tampa, FL – In a significant crackdown on cybercrime, Sandu Boris Diaconu, a 31-year-old...

WhiteSnake Stealer Checks for Mutex & VM Function Before Execution

A new variant of the WhiteSnake Stealer, a formidable malware that has been updated...

Researchers Hack AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...

New Acoustic Keyboard Side Channel Attack Let Attackers Steal Sensitive Data

In recent years, personal data security has surged in importance due to digital device...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles