Unpatched Vulnerabilities Open Doors to Cybercrooks

Patching Gaps Leave Systems Exposed

The 2018 Open Source Security and Risk Analysis report released by Black Duck Software (a developer of auditing software for open-source security) shows, that the patching of vulnerabilities still leaves much to be desired. The research found that 78% of the codebases examined contained at least one unpatched vulnerability and an average of 64 known exploits per codebase.

Real-World Breaches Highlight the Risk

If we take a look at the Equifax breach and WannaCry ransomware attack, we see that hackers were able to exploit unpatched vulnerabilities in servers operating Windows 7 and Windows 8 by targeting organizations that ran unpatched Windows software. Even after one year, WannaCry remains a threat due to unpatched systems.

According to various research reports, more than half of the breaches (around 60%) exploited unpatched vulnerabilities. Around one-third of victimized organizations were aware of their vulnerability but did not patch it yet.

How Hackers Exploit Unpatched Systems

Cybercrooks are highly creative when targeting unpatched vulnerabilities. To give a few examples:

• On a number of occasions during the first two quarters of 2018, cybercriminals used crypto mining malware (such as Coinhive and Cryptoloot) to target unpatched server vulnerabilities.
• In May 2018, hackers exploited unpatched vulnerabilities in widely-used email encryption tools PGP and S/MIME. Dubbed EFAIL, it abused active content of HTML emails to exfiltrate plaintext through requested URLs.
• On May 30^th, a hacker exploited a vulnerability to bring down Ticketfly, a website for ticket distribution services. After the attacker unsuccessfully requested ransom for sharing details of the vulnerability, he/she subsequently posted the breached data (26 million unique email addresses along with names, physical addresses, and phone numbers) online to a publicly accessible location.
• During their so-called Unicorn attack, which took place on May 2018, hackers exploited a previously unknown privilege escalation vulnerability in Microsoft OSes predating Windows 8. It allowed untrusted code (as well as users who normally have limited system rights) to gain nearly unfettered access to the most sensitive resources of an OS. With just one click on a PDF, hackers could install their malware without any downloading needed. This attack exploited both PDF and Windows vulnerabilities.
• In March 2018, the Drupalgeddon 2 vulnerability affected all sites running on Drupal 6 and later. Hackers exploited the vulnerability to install mining code on vulnerable sites such as NHS England's website. Although the vulnerability was detected more than 2 months ago, on June 5^th it was reported that more than 115,000 servers have remained unpatched.
• For hackers, it’s quite easy to find potential victims by using websites such as Shodan to find out if organizations are vulnerable  - e.g., Heartbleed and its successor OptionsBleed which is a security bug in the Apache Web Server (as opposed to OpenSSL) leveraged by making HTTP OPTIONS requests in order to potentially cause data leakage, the same way that Heartbleed still does.

Two Key Strategies to Stay Protected

1. Prioritize patching

Whenever your SOC, IT, or cybersecurity team gets an alert, make sure to run the update immediately. Any delay leaves a window of opportunity open for hackers. Secondly, run assessments to test the organization’s security posture.

2. Run Continuous Assessments

Cymulate’s Breach & Attack (BAS) platform will test the complete scope of your security for detecting any vulnerabilities and will recommend mitigation when found. The Immediate Threat alert assessment tests if your organization is vulnerable to the latest threats, which allows you to take measures before such an attack will take place.

• The Email security assessment helps you to test your corporate email security for potential exposure to a number of malicious payloads sent by email.
• The Web Gateway assessment tests your organization’s HTTP/HTTPS outbound exposure to malicious websites using an extensive and continuously growing database of malicious and compromised websites for testing.
• The Web Application Firewall assessment enables you to test your organization’s WAF security posture to web payloads by testing if the WAF configuration, implementation, and features are able to block payloads before they get anywhere near the web applications.
• The Endpoint assessment tests if your organization’s endpoint solutions are tuned properly and if they are protecting your organization against the latest attack vectors by deploying and running real ransomware, Trojans, worms, and viruses on a dedicated endpoint in a controlled and safe manner.
• The Data Loss Prevention lets you test your organization’s outbound critical data safely by evaluating how well your organization’s Data Loss Prevention (DLP) solutions and controls prevent any extraction of critical information from outside the organization.

Benefits of Cymulate’s Security Assessments

Cymulate’s platform enables the SOC team or the IT and cybersecurity teams of an organization to schedule automated assessments which can be conducted at any predefined time (e.g., every night, early in the morning, in the middle of the day, etc.) to detect vulnerabilities and gaps in the organization’s security framework, its multiple security solutions as well as security controls.

It gives a comprehensive overview of the security posture of the organization since it shows its weak spots. The results of each assessment are presented in an easy-to-understand comprehensive report. Mitigation recommendations are offered for each threat that has been discovered depending on the type of attack and phase it reached in its distribution method.

This allows you to truly understand your organization’s security posture and take action to update and upgrade where necessary.