Microsoft Netlogon exploitation continues to rise
Summary: Cisco Talos reports a spike in exploitation attempts against CVE-2020-1472, an elevation-of-privilege flaw in Netlogon stemming from a cryptographic authentication weakness in the Netlogon Remote Protocol. Attackers can forge an authentication token by sending an eight null-byte challenge, which for 1/256 session keys yields an all-zero ClientCredential, letting them impersonate any computer including the domain controller and obtain domain admin credentials.
What's compelling: A one-in-256 chance per attempt is enough to hand an attacker domain admin credentials, and Microsoft's second phase of Windows updates is not due until Q1 2021, leaving a window in which blocking non-signed or sealed connections is the recommended defense.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-1472
- Related
- CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, August 2020 Edition Cyber Risks ·