Prompt patching, or rather the lack of it, has prompted a fresh round of warnings to patch the BlueKeep vulnerability (CVE-2019-0708) that was exploited in a mass attack that started on October 23.
The attack was first detected on November 2, with the delay due to the failure of the attacker to take full advantage of the vulnerability. The campaign appears to have been conducted by a low-level threat actor who exploited the vulnerability to deliver cryptocurrency mining malware. Microsoft has issued yet another warning that worse is yet to come.
The first mass exploitation attempt certainly made the headlines, but it does not appear to have had much of an impact on the speed of patching. A scan conducted by the SANS Institute shows there has been little change in the rate of patching following the attacks. The number of unpatched devices has been steadily declining since Microsoft issued the patch in May, but hundreds of thousands of devices are still vulnerable to attack.
The attack was on a large scale, albeit with limited success. The exploit that was used failed to work properly and, in many cases, it just caused machines to crash. Successful exploitation of the vulnerability can allow a skilled threat actor to connect to vulnerable computers via RDP services with no user interaction required. Commands can be executed on vulnerable computers, which can allow the attacker to access, modify, and steal data, install malware, and launch attacks other unpatched devices on the network, even those that are not exposed to the internet.
Marcus Hutchins, the security researcher who discovered and activated a ‘kill switch’ to limit the harm caused by WannaCry ransomware in 2017, has warned that since most of the vulnerable devices are servers, even if the attacker does not develop a worm, an attack could still cause major disruption if, for instance, ransomware was deployed.
Microsoft has warned that the BlueKeep attacks are ongoing and it will only be a matter of time before a much more dangerous exploit is developed and used in a mass attack on vulnerable devices. Microsoft is urging customers to identify and update all vulnerable systems immediately.
The post Microsoft Issues Fresh Warning to Patch BlueKeep Vulnerability appeared first on HIPAA Journal.