Screenconnect
Scott Huxley
?? Security FIRST For Your Business | Speaker | Author | Cyber Security Professional | LinkedIn Humorist ????
Hot on the heels of my last article about MSP owners having everything all eggs in one basket shortly after that we all heard about the ScreenConnect incident.
A timely reminder again that we have risks in our businesses often thanks to our employees and tools. Many of the threats that exist are frequently generated by the tools we all use.
What happened
On Monday, February 19th MSPs were instructed to update their on-premise instances of ScreenConnect immediately. Connectwise at that point had already patched their cloud environments.
To protect its partners ConnectWise backdated upgrade patches for the last 20 releases too. In short, Connectwise has taken all the appropriate steps you would expect. However criminal groups did not waste time.
Enter the cybercriminals
By Friday of that week, Mandiant had identified mass exploitation of the vulnerabilities by the threat actors. In a post on the Mandiant website, they shared the following-
Many of them will deploy ransomware and conduct multifaceted exortion
Huntress had shared-
We're seeing such a variety of different attempts. - John Hammond, Principal Security Research at Huntress.
One organization, UnitedHealth Group's Change Healthcare was experiencing slowdowns at pharmacies due to a strain of Lockbit malware related to the ScreenConnect vulnerabilities. In an 8-K filing with the U.S. Securities and Exchange Commission, they had identified a suspected nation-state-associated cyber security threat actor had gained access to some of their systems.
Indeed, CISA issued a notice stating that ConnectWise partners and end customers should pull the cord on all on-prem ScreenConnect servers if they cannot update to the latest version.
ConnectWise states in their advisory that these vulnerabilities are rated as “Critical—Vulnerabilities that could allow the ability to execute remote code or directly impact confidential data or critical systems”. The two vulnerabilities are:
领英推荐
The vulnerabilities involved authentication bypass and path traversal issues within the server software itself, not the client software that is installed on the end-user devices. Attackers have found that they can deploy malware to servers or workstations with the client software installed. Sophos has evidence that attacks against both servers and client machines are currently underway.
Patching the server will not remove any malware or webshells attackers manage to deploy before patching and any compromised environments need to be investigated.
History repeats itself
As I said last week, in the MSP industry the very tools we use to support our clients and our employees represent an immense risk.
To help reduce your risk or protect yourself consider the following-
Some great reference resources for you to investigate closer-
Huntress has an amazingly great write-up. They reference a certain Windows ID that is worth reviewing for further insight too. Today is Connectwise, tomorrow it will be somebody else.
Securely Yours,
Scott
People-first IT services for small businesses throughout Central Ohio
9 个月I have two somewhat divergent takes on this - First. . .I think too many MSPs when they decide to take something like ScreenConnect (or VSA or etc) on-prem, they don't fully understand and embrace the degree to which the shared responsibility model shifts. It's like a dog chasing a car. Everything is great. But what do you do when you catch it? If you take it on-prem, everything is on you. It simply can't go on auto-pilot. To be sure, many/most MSPs do this responsibly. But history has shown us enough don't to make it. . .concerning. Second. . .with the uptick in compromises of remote support tools, I think MSPs should take a long hard look at the instances where unattended access is truly necessary. I would argue most MSPs don't need nearly as much unattended access as they have set up. How much could you reduce your attack surface by reducing unattended access from all but what's truly necessary (and keeping everything else ad-hoc)?
Cybersecurity & IT Consulting - gigabunny.com
9 个月Great Info, Thank you. One Problem is the concentration of the RAT/MSP Market, leaving only a few Suppliers, those are preferred Targets due to the large Customer numbers. I usually try to Customize Setup as much as possible, to make it at least a bit harder to get in.