Microsoft Issues Fresh Warning to Patch BlueKeep Vulnerability
Prompt patching, or rather the lack of it, has prompted a fresh round of warnings to patch the BlueKeep vulnerability (CVE-2019-0708) that was exploited in a mass attack that started on October 23.
The attack was first detected on November 2, with the delay due to the failure of the attacker to take full advantage of the vulnerability. The campaign appears to have been conducted by a low-level threat actor who exploited the vulnerability to deliver cryptocurrency mining malware. Microsoft has issued yet another warning that worse is yet to come.
The first mass exploitation attempt certainly made the headlines, but it does not appear to have had much of an impact on the speed of patching. A scan conducted by the SANS Institute shows there has been little change in the rate of patching following the attacks. The number of unpatched devices has been steadily declining since Microsoft issued the patch in May, but hundreds of thousands of devices are still vulnerable to attack.
The attack was on a large scale, albeit with limited success. The exploit that was used failed to work properly and, in many cases, it just caused machines to crash. Successful exploitation of the vulnerability can allow a skilled threat actor to connect to vulnerable computers via RDP services with no user interaction required. Commands can be executed on vulnerable computers, which can allow the attacker to access, modify, and steal data, install malware, and launch attacks other unpatched devices on the network, even those that are not exposed to the internet.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Marcus Hutchins, the security researcher who discovered and activated a ‘kill switch’ to limit the harm caused by WannaCry ransomware in 2017, has warned that since most of the vulnerable devices are servers, even if the attacker does not develop a worm, an attack could still cause major disruption if, for instance, ransomware was deployed.
Microsoft has warned that the BlueKeep attacks are ongoing and it will only be a matter of time before a much more dangerous exploit is developed and used in a mass attack on vulnerable devices. Microsoft is urging customers to identify and update all vulnerable systems immediately.
