Friday, March 29, 2024

Beware of the New Critical Zerologon Vulnerability in The Windows Server

Microsoft Patchs the new critical vulnerability in Zerologon, A feature of Netlogon allows the domain controller to authenticate computers and update passwords in the Active Directory.

“The elevation of privilege vulnerability for Zerologon, or CVE-2020-147, exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). “

“An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.” Microsoft’s Security Update stated.

This feature is particularly vulnerable to this flaw because it allows hackers to impersonate any computer in the company’s network and change the password, even if you have two fac tor authentication.

Through doing this, the hackers are able to change the domain controller’s password, gaining administrative access, and taking control of the network.

The Zerologon Patch

When this flaw was discovered by Secura researchers. Microsoft immediately rolled out a patch as Part I of their phased rollout. This phased rollout is scheduled to be completed during the first few months of 2021.

Microsoft has chosen to release the patch updates in a phased rollout, as changing protocols can result in major disruptions on networks and servers that aren’t updated.

The versions of Windows Server that the patches are available for are ones that still receive security updates from Microsoft. However, the temporary issue arises that many networks use non-Windows devices or have legacy Windows devices that use the protocol to communicate with domain controllers.

The Zerologon patch released in August is currently blocking any attacks, and protocols are in place that non-compliant clients can continue to communicate with domain controllers, avoiding disruptions.

The DHS Emergency Directive

The Department of Homeland Security has issued, on September 14, 2020, emergency directives for any federal agencies using the Windows Server to perform patching actions as a response to the high-risk information security threats. 

The Cybersecurity and Infrastructure Security Agency sent this warning to prevent a compromise of agency information systems. Any servers that were unable to update their domain controllers by the deadline on September 21, 2020, were directed to unplug from the networks.

Protecting Your Organization

The first thing you should do is work with your IT department to ensure the patch from Microsoft is implemented on your network immediately if it hasn’t been done so already. August’s patch from Microsoft added five Event IDs for vulnerable Netlogon connections. When a secure channel connection during the initial deployment phase is allowed, event ID 5829 is generated.

To detect the Zerologon vulnerability, look for Event ID 4742, specifically “ANONYMOUS LOGON” users, and check the Password Last Set field for any changes. Your IT department will also be able to look for activity of all domain controllers in the Active Directory with this code:

norm_id=WinServer label=Computer label=Account label=Change computer=* user=”ANONYMOUS LOGON” user_id=”S-1-5-7″ password_last_set_ts=*

Admins have the ability to monitor for Event IDs 5827 an 5828. These are triggered when Netlogon connections are denied. Event IDs 5830 and 5831 are triggered when the Group Policy allows patched domain controllers from Netlogon connections.

It’s recommended that this situation continues to be monitored, as this patch and any issues that arise from it are ongoing. At the time of publication, Microsoft has not identified any mitigating factors or workarounds for this vulnerability aside from the Zerologon patch.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles