On September 14, the Cybersecurity and Infrastructure Agency (CISA) announced that a damaging exploit code for CVE-2020-1472 was publicly available. Within 24 hours, Darktrace AI had detected a cyber-attack on a healthcare company exploiting this very flaw.
CVE-2020-1472, or ZeroLogon, is a particularly concerning vulnerability since, despite its sophistication, a low skill level is required to capitalize on it, and successful exploitation results in administrative control over an entire digital system. Attackers have been quick to share and utilize versions of the weaponized exploit code, targeting companies to gain control and cause damage.
The vulnerability comes from the ‘Netlogon’ Remote Protocol (MS-NRPC), which authenticates users accessing Windows Servers. A flaw in the cryptography means that there is a probability – 1/256, that the cipher text will come out as a sequence of zeros and not random numbers. The Initialization Vector (IV) can thus be set to zeros in an average of 128 attempts: a few seconds for an attacker.
Attackers can then take control of any computer, including the root domain controller, by resetting the computer’s password. Hackers commonly use public red-teaming tools to facilitate this attack, such as the use of Cobalt Strike for command and control (C2). If a cyber-criminal is successful in gaining domain admin privileges, the results can be devastating. Once in control, the attacker could launch a denial of service or ransomware attack or exfiltrate sensitive company data.
Darktrace’s unique approach defends against such vulnerabilities by detecting new and unknown threats in their earliest stages. The visibility provided by Darktrace Cyber AI allows security teams to quickly correlate all related activity and respond accordingly.
Attack overview
Figure 1: A timeline of the attack
Darktrace detected a ZeroLogon exploitation at a healthcare company in Europe. Hackers were detected using the CVE-2020-1472 privilege escalation flaw to try to gain domain admin control, with a view to taking over the digital system or perhaps causing a denial of service.
Figure 2: Model Breach Event Log for the unusual RPC detection, detailing the numerous calls to Netlogon within a short time frame
The company had around 50,000 devices across its digital estate. One device began making a large volume of repeated TXT DNS requests, resembling the DNS Beacon from Cobalt Strike. Approximately one week later, the device made a large volume of unusual RPC calls to an internal domain controller. Successful calls to the ‘Netlogon’ service were observed, indicating that this was an exploitation of the ZeroLogon vulnerability.
Darktrace’s Cyber AI Analyst launched an automatic investigation into the incident and generated a high-level summary in natural language, surfacing the key metrics to the security team.
Figure 3: AI Analyst coverage of the initial command and control activity from the device in question
The C2 activity was entirely conducted using DNS. As this was a new vulnerability, the hackers were able to bypass the rest of the security stack, undetected by traditional antivirus and signature-based tools. In total, the time spent in the company’s digital environment was approximately eight days.
Cyber-criminals don’t hang around
CVE-2020-1472 was first published on August 11 and a partial patch was released by Microsoft at the time. On September 14, CISA addressed their awareness of the ZeroLogon exploit code. The Common Vulnerability Scoring System (CVSS) had given it a severity score of 10/10.
The AI detection and response took place less than 24 hours after this notice, demonstrating how quickly modern cyber-criminals move.
Unpatched vulnerabilities account for 60% of all cyber-attacks and are ubiquitous in cyber-space. Human security teams simply cannot keep up with the ever-increasing number of vulnerabilities and patches released by software vendors. There is always a delay as IT teams rush to implement the necessary defenses. Microsoft is planning to release a more complete patch, but this is not scheduled until February 2021.
Crucially, traditional security tools that rely on the ‘legacy approach’ – using pre-defined rules and playbooks of known threats – are blind to these vulnerabilities. The speed at which the attackers moved in this case demonstrates the importance of detecting unusual behaviors at the earliest stages of an attack.
Autonomous Response
Darktrace’s AI picked up on this attack immediately, as soon as the device had begun the Cobalt DNS Beacon. In active mode, Antigena, Darktrace’s Autonomous Response capability, would have actioned a surgical response to block the command and control (C2) activity as well as the suspicious RPC requests to the internal domain controller. In this instance, Darktrace Antigena was set to passive mode, and so the attack was allowed to continue.
In today’s fast-moving cyber landscape, AI defense is instrumental in fighting back against potential threats. Darktrace Cyber AI does not rely on rules and signatures, but spots novel threats by understanding the ‘pattern of life’ for every user and device, and flagging anomalous activity as it happens, protecting companies from zero-day exploits and new vulnerabilities such as ZeroLogon.
Thanks to Darktrace analyst Kendra Gonzalez Duran for her insights on the above threat find.
Learn more about Autonomous Response
Darktrace model detections:
- Compromise / DNS / Possible DNS Beacon
- Compromise / DNS / Cobalt DNS
- Compromise / DNS / DNS Tunnel with TXT Records
- Compromise / Suspicious Netlogon RPC Calls
