Fraud News

It has been nine days since Microsoft patched the high-severity vulnerability known as BlueKeep, and yet the dire advisories about its potential to sow worldwide disruptions keep coming.

Until recently, there was little independent corroboration that exploits could spread virally from computer to computer in a way not seen since theWannaCryand NotPetya worms shut down computers worldwide in 2017. Some researchers felt Microsoft has been unusually tight-lipped with partners about this vulnerability, possibly out of concern that any details, despite everyone’s best efforts, might hasten the spread of working exploit code.

Until recently, researchers had to take Microsoft's word the vulnerability was severe. Then five researchers from security firm McAfee reported last Tuesday that they were able to exploit the vulnerability and gain remote code execution without any end-user interaction. The post affirmed that CVE-2019-0708, as the vulnerability is indexed, is every bit as critical as Microsoft said it was.

“There is a gray area to responsible disclosure,” the researchers wrote. “With our investigation we can confirm that the exploit is working and that it is possible to remotely execute code on a vulnerable system without authentication."

Only a matter of time

Wednesday saw two more posts about BlueKeep. One from security firm ESET was succinctly headlined, "Patch now! Why the BlueKeep vulnerability is a big deal." In it, ESET Security Evangelist Ondrej Kubovič wrote: “Right now, it is only a matter of time until someone publishes a working exploit or a malware author starts selling one on the underground markets. Should that happen, it will probably become very popular among less skilled cybercriminals and also a lucrative asset for its originator.”

The vulnerability resides in Microsoft’s proprietary Remote Desktop Protocol, which provides a graphical interface for connecting to another computer over the Internet. Exploiting the vulnerability—which is present in older versions of Windows but not the much better secured Windows 8 and 10—requires only that an attacker send specific packets to a vulnerable RDP-enabled computer. In a testament to the severity, Microsoft took the highly unusual step of issuing patches for Windows 2003, XP, and Vista, which haven’t been supported in four, five, and seven years, respectively.

In a separate post published Wednesday, security organization SANS continued the drum beat of dire warnings.

“Being vulnerable exposes two fundamental weaknesses in your network: You are still running Windows 7 (or XP??), and you are exposing RDP,” SANS Dean of Research Johannes B. Ullrich wrote. “Neither is good, and both issues need to be addressed. With this focus on RDP, there is a good chance that additional vulnerabilities will be found in the next few months. If this is true, then fire drills will continue until you can get these two issues resolved.”

Starting in May 2017, WannaCry and another worm calledNotPetyathat spread a month later shut down computers around the world, leading to hospitals turning away patients, train stations not functioning normally, and international shippers suffering major disruptions.

A key to both worms’ spread was the exploitation of a vulnerability in older versions of Windows. Attackers had a head start in exploiting the flaws. A month after Microsoft quietly patched the holes, highly reliable exploit code developed by and later stolen from the National Security Agency was published by a still-unknown group calling itself the Shadow Brokers. Almost immediately afterward, the so-called "Eternal Blue" code was repurposed in real-world attacks.

About the only thing keeping BlueKeep from being used for similar real-word attacks right now is the lack of reliable exploit code—and that is likely to change.

“It does appear non-trivial to develop a reliable remote code execution exploit for this vulnerability, which will hopefully get us a few more days until one is publicly available,” SANS’ Ullrich wrote. “However, exploit development is active, and I don't think you have more than a week.”

Craig Dods, a senior engineer at network equipment provider Juniper, said Microsoft partners have scrambled to develop defenses even as Microsoft declined to provide as many technical details as they would have liked. In a message, he wrote:

"I'm sure there are non-zero risks associated with sharing technical details with security partners,” he wrote. “It's possible that information could leak out in some form or fashion, reducing the amount of time customers have to patch. But on the flip-side, having security vendors be left in the dark is also not a great solution. We're left collectively scrambling to reverse a set of patches, effectively in a race against people who are going to take advantage of it for monetary or political gain."

The concern, Dods and other security experts said, is compounded by the use of vulnerable versions of Windows in some of the most mission-critical of environments. They include hospitals, factories, and other industrial settings, where patching is complicated by governmental compliance requirements or 24/7 operating schedules.

“It's going to be a massive issue, particularly for ICS-style networks, for years to come,” Dods said, referring to industrial control systems.

He warned that the vulnerability might in some cases be exploited even when affected RDP services are secured with Network Level Authentication, which requires a machine to provide a password before connecting to another computer. In the event attackers obtained the credentials—as often happens during days or weeks of network surveillance preceding ransomware attacks—vulnerable RDP services exposed to the Internet would be wide open.

Seriously—patch now

All of the posts stress that the most effective protection is for vulnerable systems to receive the patch Microsoft issued earlier this month. Disabling RDP can also be effective. When RDP is required, it should be enabled only on machines that truly need it and available only over local networks or with the use of a robust virtual private network. Intrusion detection signatures from NCC Group and Snort rules from Cisco for this vulnerability are available here and here, respectively. Ullrich has provided exploit packet captures here.

While the remedies may be difficult and costly for many organizations to implement, consensus is emerging that the consequences of taking no action could easily be much worse. One of the early warnings came five days ago when a security researcher took to Twitter to issue a blunt assessment of the destruction that’s possible.

“I get the CVE-2019-0708 exploit working with my own programmed POC (a very real dangerous POC),” the researcher wrote. “This exploit is very dangerous. For this reason i don´t will said TO ANYBODY OR ANY ENTERPRISE nothing about it. You are free of believe me or not,i dont cared [sic].”

22 May 2019

Huawei Faces Break With UK Chip Giant ARM

Image copyright Getty Images Image caption Huawei unveiled new phones powered by ARM-based chips, on Tuesday

UK-based chip designer ARM has told staff it must suspend business with Huawei, according to internal documents obtained by the BBC.

ARM instructed employees to halt "all active contracts, support entitlements, and any pending engagements” with Huawei and its subsidiaries to comply with a recent US trade clampdown.

ARM's designs form the basis of most mobile device processors worldwide.

In a company memo, it said its designs contained “US origin technology”.

As a consequence, it believes it is affected by the Trump administration's ban.

One analyst described the move, if it became long-term, as an “insurmountable” blow to Huawei’s business.

He said it would greatly affect the firm's ability to develop its own chips, many of which are currently built with ARM’s underlying technology, for which it pays a licence.

These are used in the Chinese company's 5G base stations and computer servers in addition to its smartphones.

Cambridge-headquartered ARM had been described as the UK's largest tech firm until its takeover by a Japanese fund. It employs 6,000 workers and lists eight offices in the US.

In a statement on Wednesday it said: "ARM is complying with the latest restrictions set forth by the US government and is having ongoing conversations with the appropriate US government agencies to ensure we remain compliant.

"ARM values its relationship with our long-time partner HiSilicon and we are hopeful for a swift resolution on this matter."

Huawei has issued a brief statement of its own.

"We value our close relationships with our partners, but recognise the pressure some of them are under, as a result of politically motivated decisions," it said.

"We are confident this regrettable situation can be resolved and our priority remains to continue to deliver world-class technology and products to our customers around the world."

What is ARM?

Image copyright ARM

ARM is a chip designer founded in 1990. In September 2016 it was acquired by Japanese telecoms giant Softbank, but remains based in Cambridge, UK.

ARM does not manufacture computer processors itself, but rather licenses its semiconductor technologies to others.

In some cases, manufacturers only license ARM's architecture, or "instruction sets", which determine how processors handle commands. This option gives chip-makers greater freedom to customise their own designs.

In other cases, manufacturers license ARM's processor core designs - which describes how the chips' transistors should be arranged. These blueprints still need to be combined with other elements - such as memory and radios - to create what is referred to as a system-on-chip.

As a result, when you hear talk of a device being powered by a Samsung Exynos, Qualcomm Snapdragon or Apple A11 chip - or one in a Huawei smartphone - it is still ARM's technology that is involved.

ARM's US headquarters are in San Jose, California, and the firm has offices in Washington, Arizona, Texas and Massachusetts.

‘Unfortunate situation’

ARM’s staff were informed of the decision on 16 May, following the US Commerce Department’s move to add Huawei to its “entity list” of companies with which American firms could no longer do business.

The BBC has also seen a company memo dated 18 May detailing the implications of the export ban.

On Monday 20 May, US government officials issued a 90-day reprieve on some of the restrictions in order to minimise immediate disruption. But ARM believes that the temporary licence involved does not apply to it.

A spokesman for ARM declined to offer any additional clarity about the current status of its Huawei contracts.

Image copyright Huawei Image caption A break with ARM would make it difficult for Huawei to develop future generations of its Kirin processors

According to one memo, ARM staff were instructed to suspend all interactions with Huawei and its subsidiaries.

It advised staff to send a note informing Huawei (or related) employees that due to an “unfortunate situation”, they were not allowed to “provide support, delivery technology (whether software, code, or other updates), engage in technical discussions, or otherwise discuss technical matters with Huawei, HiSilicon or any of the other named entities”.

ARM staff that come into contact with employees at industry events must “politely decline and stop” any conversations about the business, the guidance said - stressing that individuals could be held personally liable for breaking the trade rules.

The ban also appeared to apply to ARM China, the China-based company in which ARM Holdings owns a 49% stake. It was set up as a joint venture with a Chinese investment consortium last year in order to enable ARM to develop, sell and offer support for its products in the region.

'Insurmountable obstacle'

Huawei told reporters on Tuesday that its “plan B” for software would be to develop its own operating system, something it has already been working on for some time. However, it will be significantly more difficult for the firm to source home-grown components of sufficient quality.

Huawei currently sources some of its chips from HiSilicon, which it owns. However, while produced in China, HiSilicon’s chips are built using underlying technology created by ARM.

While HiSilicon and Huawei are free to carry on using and manufacturing existing chips, the ban would mean the company could no longer turn to ARM for assistance in developing components for devices in future.

HiSilicon's upcoming processor, Kirin 985, is due be used in Huawei devices later this year. According to a source at ARM, it is not expected to be affected by the ban. However, the next iteration of the chip has not yet been completed - and is likely to need to be rebuilt from scratch, the source said.

Huawei also uses ARM's designs for its recently unveiled Kunpeng chips. These are used to power its TaiShan-series computer servers, which are designed to provide cloud computing and storage to clients.

In addition, the company told analysts in January that the Tiangang chip at the heart of its 5G base stations is also ARM-based.

Image copyright Capacitymedia.com Image caption Huawei's carrier division chief Ryan Ding showed off its 5G base station chip alongside an image saying it involved a "high-performance ARM-based processor"

"The problem of the whole telecoms industry is that so much of it is based on the exchange of technology between different companies - whether that's chip companies, software providers or the makers of other hardware," commented Alan Burkitt-Gray, editor-at-large of the telecoms news site Capacity Media.

He added that Huawei would likely face other problems licensing 5G-related tech from others, and in turn US-based companies would now be unable to licence the Chinese company's 5G inventions.

"This will carve out a chasm in the industry between Huawei-originated intellectual property and the rest of the world's," he said.

"It's just a total mess and it's happened at a critical time for the rollout of 5G."

The relationship between ARM and Huawei engineers is tight - earlier this month Huawei announced its intention to build a research centre only 15 minutes from ARM’s headquarters in Cambridge, UK.

Image copyright Reuters Image caption The latest development follows news that Huawei will lose access to some of Google's Android services

"ARM is the foundation of Huawei’s smartphone chip designs, so this is an insurmountable obstacle for Huawei,” said Geoff Blaber, from CCS Insight.

"That said, with an abundance of companies in Huawei’s supply chain already having taken action to comply with the US order, Huawei’s ability to operate was already severely affected.”

What is not yet clear is whether ARM is acting on its own interpretation of the US rules, or whether it has been advised by the Commerce Department.

"If that interpretation is correct, that’s going to affect every semiconductor company in the world,” remarked analyst Lee Ratliff, from IHS Markit.

"They’re not going to be able to easily replace these parts with new, in-house designs - the semiconductor industry in China is nascent.”

_______

Additional reporting by Leo Kelion

Follow Dave Lee on Twitter @DaveLeeBBC

Do you have more information about this or any other technology story? You can reach Dave directly and securely through encrypted messaging app Signal on: +1 (628) 400-7370

Original link

Fraud News

Ethereum Smart Contracts Exploitation Using Right-To-Left Override Character

Mozilla Patches 24 Firefox Vulnerabilities

Topics:

Would You Pay $1 Million For A Laptop Full Of Malware?

UK Says It Warned 16 NATO Allies Of Russian Hacking Activities

Deterrence is the key

Related government coverage:

Team Viewer Hit By Chinese Hackers In 2016

Why A Windows Flaw Patched 9 Days Ago Is Still Spooking The Internet

Only a matter of time

Seriously—patch now

Millions Of Golfers Land In Privacy Hazard After Cloud Misconfig

Huawei Faces Break With UK Chip Giant ARM

What is ARM?

‘Unfortunate situation’

'Insurmountable obstacle'

Meet

Resources

More About Us