Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

US Cyber Command: Patch Windows ‘Bad Neighbor’ TCP/IP Bug Now

US Cyber Command: Patch Windows ‘Bad Neighbor’ TCP/IP Bug Now

US Cyber Command warns Microsoft customers to immediately patch their systems against the critical and remotely exploitable CVE-2020-16898 vulnerability addressed during this month’s Patch Tuesday.

“Update your Microsoft software now so your system isn’t exploited: CVE-2020-16898 in particular should be patched or mitigated immediately, as vulnerable systems could be compromised remotely,” US Cyber Command said in a tweet earlier today.

Microsoft states that the CVE-2020-16898 bug, also known as ‘Bad Neighbor’, is a remote code execution (RCE) vulnerability in the Windows TCP/IP stack that can also be used to trigger a denial of service (DoS) leading to a Blue Screen of Death (BSoD).

This bug can be exploited remotely by unauthenticated attackers who send maliciously crafted ICMPv6 Router Advertisement packets to a target Windows computer.

Bad Neighbor impacts both client (Windows 10 versions 1709 up to 2004) and server (Windows Server version 1903 up to 2004 and Windows Server 2019) platforms, making it a critical vulnerability for all modern Windows environments.

Also Read: How To Secure Your WiFi Camera? 4 Points To Consider

Microsoft’s October 2020 Patch Tuesday fixed 87 vulnerabilities in total, 12 of them classified as Critical, 74 as Important, and one as moderate severity.

Denial of service proof-of-concept exploits

Microsoft has already shared a proof-of-concept (POC) with MAPP members according to a blog post published by McAfee Labs yesterday,

“The proof-of-concept shared with MAPP (Microsoft Active Protection Program) members is both extremely simple and perfectly reliable,” McAfee Labs said.

“It results in an immediate BSOD (Blue Screen of Death), but more so, indicates the likelihood of exploitation for those who can manage to bypass Windows 10 and Windows Server 2019 mitigations.”

Based on the details provided by Microsoft, British security firm Sophos has also been able to create a denial of service POC which causes a BSOD on any vulnerable Windows 10 or Windows Server devices.

It would not be surprising if threat actors will also soon create their own DoS exploits.

Also Read: 5 Common Sections in an Agreement Form Example

While developing a denial-of-service POC that would allow attackers to cause BSODs remotely is reasonably easy, creating an RCE exploit is extremely hard.

As SophosLabs Offensive Security researchers explained, the attackers’ POC exploit would need to reliably bypass stack canaries and kernel Address Space Layout Randomization (ASLR) to successfully achieve remote code execution.

“Even so, the threat of denial of service at will with a relatively easily-crafted packet should be enough by itself to prompt rapid patching—which is the only real fix for this vulnerability,” Sophos added.

CVE-2020-16898 mitigation

Microsoft provides a workaround for all customers who can’t immediately apply the security update that addresses this critical security bug.

Microsoft advises customers who can’t install the update to disable the ICMPv6 Recursive DNS Server (RDNSS) option using the following PowerShell command on systems running Windows 1709 and above (no reboot is needed):

netsh int ipv6 set int *INTERFACENUMBER* rabaseddnsconfig=disable

To re-enable ICMPv6 RDNSS once you applied the security update you have to use this PowerShell command (no reboot needed):

netsh int ipv6 set int *INTERFACENUMBER* rabaseddnsconfig=enable

However, it should be noted that this is only a short term fix that blocks known attack vectors, and that you can fully mitigate the vulnerability and protect vulnerable systems only by applying the security update.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us