Michael McNamara

technology, networking, virtualization and IP telephony

How to scan for machines vulnerable to WannaCrypt / WannaCry ransomware

by

You’ve patched all your Windows servers and desktop/laptops but what about all the other Windows machines out there that are connected to your network? What about the kioks and Thin Clients and environmental controllers and printer servers, etc? How can you tell if they are patched if you don’t have administrative access to the devices? You can scan your network using a vulnerability scanner. There are many ways to scan your network for machines that are vulnerable to WannaCrypt / WannaCry ransomware but I’ll be talking about using Nmap, a free security scanning tool, in this blog post.

You’ll need the latest version of Nmap v7.40 which you’ll be able to find on Linux (Ubuntu, CentOS, etc) or on Windows thanks to the available binaries for both platforms. I didn’t have any success using Nmap v6.40 which was available via YuM on CentOS 7. So I had to remove Nmap 6.40 (sudo yum erase nmap) and then install the latest RPM version of Nmap which can be found on the downloads page.

I was using CentOS 7 x64 so I issued the following commands;

[mcnamaram1@centos ~]# sudo yum erase nmap
[mcnamaram1@centos ~]# wget https://nmap.org/dist/nmap-7.40-1.x86_64.rpm
[mcnamaram1@centos ~]# sudo rpm -ivh nmap-7.40-1.x86_64.rpm

Paulino Calderon released a NSE (Nmap Scripting Engine) script on Github that can be easily used with Nmap to detect vulnerable machines. You’ll need to download that script as well.

[mcnamaram1@centos ~]# wget https://raw.githubusercontent.com/cldrn/nmap-nse-scripts/master/scripts/smb-vuln-ms17-010.nse

I used the following command line arguments to run the actual scan and found an old Windows XP machine in my home that was vulnerable.

[mcnamaram1@centos ~]# sudo nmap -p445 --script smb-vuln-ms17-010.nse 192.168.1.0/24
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-15 21:29 EDT
Nmap scan report for 192.168.1.0

Nmap scan report for PLUTO.home (192.168.1.79)
Host is up (0.058s latency).
PORT    STATE SERVICE
445/tcp open  microsoft-ds
MAC Address: 00:21:91:81:A7:1D (D-Link)

Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|_      https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

If you’re not a Linux guy or gal you can also use the Windows version of Nmap. The installation was pretty straight forward, I had to download the script to the Windows desktop, create a profile, add the script and select a target. In this case I decided to scan my entire home network IP subnet of 192.168.1.0/24 and the Windows version found the same vulnerable Windows XP desktop;

You’d be surprised what you might find connected to the network.

Good Luck!

Where is Seychelles?

by

With the Christmas break and holidays upon us I usually get a few days to tend to the digital upkeep of my little fiefdom.  The plan this year was to add HTTPS/SSL capability to my blog with a wildcard SSL certificate from RapidSSL. While I was installing the certificate I noticed a large number of odd POST requests in the logs;

::ffff:89.248.172.6 - - [26/Dec/2015:18:53:22 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:22 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:22 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:22 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:22 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:24 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:25 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:25 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"
::ffff:89.248.172.6 - - [26/Dec/2015:18:53:25 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;  http://www.google.com/bot.html)"

I was naturally curious and started digging through my logs, I found 427,358 requests from that IP network over the past two weeks. Using whois I was able to identify the network and hosting provider where the requests were originating from.

[root@moon logs]# whois 89.248.172.6
[Querying whois.ripe.net]
[whois.ripe.net]
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '89.248.172.0 - 89.248.172.57'

% Abuse contact for '89.248.172.0 - 89.248.172.57' is 'abuse@ecatel.net'

inetnum:        89.248.172.0 - 89.248.172.57
netname:        SC-QUASI40
descr:          QUASI
country:        SC
admin-c:        QNL1-RIPE
tech-c:         QNL1-RIPE
status:         ASSIGNED PA
mnt-by:         QUASINETWORKS-MNT
mnt-lower:      QUASINETWORKS-MNT
mnt-routes:     QUASINETWORKS-MNT
created:        2008-06-21T17:49:26Z
last-modified:  2015-11-09T13:20:10Z
source:         RIPE # Filtered

role:           Quasi Networks LTD
address:        Suite 1, Second Floor
address:        Sound & Vision House, Francis Rachel Street
address:        Victoria, Mahe, SEYCHELLES
remarks:        *****************************************************************************
remarks:        IMPORTANT INFORMATION
remarks:        *****************************************************************************
remarks:        We are a high bandwidth network provider offering bandwidth solutions.
remarks:        Government agencies can sent their requests to gov.request@quasinetworks.com
remarks:        Please only use abuse@quasinetworks.com for abuse reports.
remarks:        For all other requests, please see the details on our website.
remarks:        *****************************************************************************
abuse-mailbox:  abuse@quasinetworks.com
nic-hdl:        QNL1-RIPE
mnt-by:         QUASINETWORKS-MNT
created:        2015-11-07T22:43:04Z
last-modified:  2015-11-07T23:04:49Z
source:         RIPE # Filtered

% Information related to '89.248.172.0/23as29073'

route:          89.248.172.0/23
descr:          Quasi Networks LTD (IBC)
origin:         as29073
mnt-by:         QUASINETWORKS-MNT
created:        2007-11-19T14:34:49Z
last-modified:  2015-11-09T13:24:19Z
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.83.1 (DB-1)

I had never heard of Seychelles before, but Google pointed out that it’s a collection of islands off the east coast of Africa. I would personally think that bandwidth would be expensive there but I’m guessing the miscreants don’t mind paying for it.

It was pretty clear from the logs that this IP address was trying infiltrate the XMLRPC service in WordPress while hoping to avoid detection by using the Googlebot agent string. If anything using the Googlebot agent string actually draws attention to the request.

While not a foolproof solution, I’ve added another IP network into my server firewall tables.

I did a quick scan of the logs and found 38 distinct IP addresses had tried to login to my WordPress blog a total of 359 times since midnight. A number of IP addresses were from proxy and VPN providers of which the majority were based in the continental United States. There were 104 attempts from 104.193.120.218 which belongs to a service provider in Farmington Hills, MI and resolves to solutionslick.net which is a front to adult porn sites.

I’d love to spend more time pouring over my log files but I just don’t have the time or energy.

Cheers!

Apple iOS 8 randomises WiFi MAC addresses

by

We learned this past week that Apple’s iOS 8 will offer the ability to randomize the WiFi MAC address while it scans for wireless networks. While the feature itself seems appealing from a privacy perspective it has me seeking to understand how they intend to technically implement this feature.

iOS8MACAddress

I’ve seen more than my fair share of duplicate IP address issues over the years and I’m wondering how Apple is going to implement this feature to prevent duplicate MAC addresses? And in that same thought how is this change going to impact other systems. It’s obviously going to impact those solutions that promise to track customers through retail spaces. Although the proposed change by Apple only covers the WiFi SSID scanning, once you connect to a guest/public hotspot iOS 8 will use the real WiFi MAC address which can then be tracked. How will this impact an Access Point or Wireless LAN Controller? What if a wireless network utilizes band steering and probe response spoofing?

Anyone have any technical details regarding how they will actually randomize the MAC address?

Cheers!

Data Loss Prevention in Healthcare

by

I recently gave a presentation to an Information Services audience around the topic of Data Loss Prevention. The goal of the presentation was to raise awareness among the audience members with respect to HIPAA and HITECH around Data Loss Prevention and to help introduce the topic.

At the beginning of the presentation I asked the audience the following questions, trying to make the presentation interactive;

  1. Who in the audience has ever been a victim of credit card fraud?
  2. Who in the audience has ever been a victim of identity theft?
  3. Who in the audience has ever been a victim of medical identity theft?

There were a surprising number of hands raised for each question which seemed to shock some of the audience members.

 Information Security

  • Confidentiality
  • Integrity
  • Availability

We’re the problem?

DLP-Figure1

Facts and Statistics

DLP-Figure2
Third Annual Benchmark Study on Patient Privacy & Data Security, Ponemon 2012
DLP-Figure3
Third Annual Benchmark Study on Patient Privacy & Data Security, Ponemon 2012
  • Thus far in 2013, 48 percent of reported data breaches in the United States have been in the medical/healthcare industry. In 2012, there were 154 breaches in the medical and healthcare sector, accounting for 34.5 percent of all breaches in 2012, and 2,237,873 total records lost.
    – ITRC Breach Report, Identity Theft Resource Center, May 2013

Data Loss Prevention

  • Data Loss Prevention includes People, Processes and Technology.It’s not a problem that technology can solve by itself instead it requires governance, policies, procedures, access controls, incident response, endpoint security, and training along with auditing and monitoring.
  • Data at Rest – Where is my confidential data stored?
  • Data at Motion – Where is my confidential data going?

Why?

  • Reduce Risk – prevent breaches, prevent loss of PHI and IP
  • Comply with Regulatory Requirements – HIPAA/HiTech

Questions, Comments, Thoughts?

There was a surprising number of questions and comments at the end of the presentations. I had thought people were starting to look glossed over half-way through, perhaps because I had too many statistics and facts but I was trying to make sure they understood the gravity of the problem. Now the real work begins as we try and implement a data loss prevention policy.

Cheers!

Verizon Email Servers now supporting SSL?

by

It’s true and you need to make some configuration changes as soon as possible if you utilize a Verizon email account.

I received the following notification this week that informs Verizon customers that Verizon’s Email servers are now supporting SSL when utilizing POP3 and SMTP to send and receive email from a traditional email client such as Mozilla’s Thunderbird,  Microsoft’s Outlook or your Android or Apple Smartphone.

VerizonSSLEmail

This is very exciting news because you hopefully already know that your username and password are sent in the clear when utilizing POP3 and SMTP (with authentication) when not utilizing SSL. So the answer to the ages old question of does Verizon support SSL encryption has changed? They now support SSL encryption on both the POP3 (receiving) and SMTP (sending) for traditional email clients.

OutlookVerizonPOP3-1I made the changed to my Microsoft Outlook client and it works perfectly.

OutlookVerizonPOP3-2

You’ll need to dig deep into the settings to modify the port numbers that are utilized for both POP3 and SMTP, they can be found under “More Settings…”

You can find additional configuration information on Verizon’s website at this link.

I also recently noticed that Verizon now redirects any attempts to connect to http://webmail.verizon.net to the SSL secured site at https://webmail.verizon.net which again is very exciting from a security perspective.

Now you can safely utilize that public hotspot or guest network without worrying if someone is going to steal your username and password when you try and check your inbox. This change is long overdue and very welcome in my opinion.

Cheers!

Update: March 20, 2013

I just noticed that Verizon is only encrypting the actual login (passing the user credentials). They are not encrypting the entire session which includes the actual contents of the message or any attachments. This approach was helpful 5 years ago but not today, I’m not sure if Verizon is using secure COOKIES or not but this approach is usually susceptible to session hijacking.

Recent Posts

Categories

SUBSCRIBE BY EMAIL