Beware of the New Critical Zerologon Vulnerability in The Windows Server

Microsoft Patchs the new critical vulnerability in Zerologon, A feature of Netlogon allows the domain controller to authenticate computers and update passwords in the Active Directory.

“The elevation of privilege vulnerability for Zerologon, or CVE-2020-147, exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). “

“An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.” Microsoft’s Security Update stated.

This feature is particularly vulnerable to this flaw because it allows hackers to impersonate any computer in the company’s network and change the password, even if you have two fac tor authentication.

Through doing this, the hackers are able to change the domain controller’s password, gaining administrative access, and taking control of the network.

The Zerologon Patch

When this flaw was discovered by Secura researchers. Microsoft immediately rolled out a patch as Part I of their phased rollout. This phased rollout is scheduled to be completed during the first few months of 2021.

Microsoft has chosen to release the patch updates in a phased rollout, as changing protocols can result in major disruptions on networks and servers that aren’t updated.

The versions of Windows Server that the patches are available for are ones that still receive security updates from Microsoft. However, the temporary issue arises that many networks use non-Windows devices or have legacy Windows devices that use the protocol to communicate with domain controllers.

The Zerologon patch released in August is currently blocking any attacks, and protocols are in place that non-compliant clients can continue to communicate with domain controllers, avoiding disruptions.

The DHS Emergency Directive

The Department of Homeland Security has issued, on September 14, 2020, emergency directives for any federal agencies using the Windows Server to perform patching actions as a response to the high-risk information security threats. 

The Cybersecurity and Infrastructure Security Agency sent this warning to prevent a compromise of agency information systems. Any servers that were unable to update their domain controllers by the deadline on September 21, 2020, were directed to unplug from the networks.

Protecting Your Organization

The first thing you should do is work with your IT department to ensure the patch from Microsoft is implemented on your network immediately if it hasn’t been done so already. August’s patch from Microsoft added five Event IDs for vulnerable Netlogon connections. When a secure channel connection during the initial deployment phase is allowed, event ID 5829 is generated.

To detect the Zerologon vulnerability, look for Event ID 4742, specifically “ANONYMOUS LOGON” users, and check the Password Last Set field for any changes. Your IT department will also be able to look for activity of all domain controllers in the Active Directory with this code:

norm_id=WinServer label=Computer label=Account label=Change computer=* user=”ANONYMOUS LOGON” user_id=”S-1-5-7″ password_last_set_ts=*

Admins have the ability to monitor for Event IDs 5827 an 5828. These are triggered when Netlogon connections are denied. Event IDs 5830 and 5831 are triggered when the Group Policy allows patched domain controllers from Netlogon connections.

It’s recommended that this situation continues to be monitored, as this patch and any issues that arise from it are ongoing. At the time of publication, Microsoft has not identified any mitigating factors or workarounds for this vulnerability aside from the Zerologon patch.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates