The latest on Blue Keep and Deja Blue vulnerabilities — Using Firepower to defend against encrypted Deja Blue
Summary: Cisco Talos published protections for the DejaBlue remote code execution vulnerabilities CVE-2019-1181 and CVE-2019-1182, with Snort SID 51369 blocking exploitation of both, and detailed steps for decrypting RDP traffic on an inline Firepower device to inspect it. A November 2019 update reported active exploitation of BlueKeep (CVE-2019-0708), with preliminary reports indicating adversaries used access to compromised systems to install cryptocurrency mining malware, and no evidence suggesting a new worm.
Why it matters: Working remote code execution exploits for DejaBlue had been developed but not publicly released at the time of writing, and the BlueKeep exploitation shows attackers converting compromised systems into cryptocurrency miners before patches land. The guidance to restrict RDP and SMB exposure and apply updates rests on the premise that detection and prevention take time to stand up.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-0708CVE-2019-1181CVE-2019-1182
- Related
- Patch Tuesday, August 2019 Edition Cyber Risks ·CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021