Archiv für die Kategorie: News

By Talos Group Over the past few months, Microsoft has released several security updates for critical Remote Desktop Protocol (RDP)-related security bugs. These bugs are significant for IT infrastructure because they are classified as “wormable,” meaning future malware that exploits them could spread from system to system without requiring explicit user interaction. These vulnerabilities could be exploited by an attacker sending a specially crafted request to the target system’s Remote Desktop Service via RDP. We have seen how destructive these kinds of attacks can be, most notably WannaCry. We highly recommend organizations immediately apply Microsoft’s patches. Cisco Talos released detection coverage for CVE-2019-0708 and also enhanced guidance to help organizations facilitate inspection of RDP sessions here. Microsoft published additional security updates last month to mitigate two additional remote code execution vulnerabilities, CVE-2019-1181 and CVE-2019-1182, affecting several versions of Microsoft Windows. These bugs are referred to as “DejaBlue” due to their similarities to BlueKeep.
Once again, Cisco Talos started working immediately to reverse-engineer the RCE vulnerabilities. Exploits and protections for both CVE-2019-1181 and CVE-2019-1182 now exist to keep your systems secure. SID 51369 for SNORT® correctly blocks exploitation of CVE-2019-1181 and CVE-2019-1182. In this post, we’ll run through the details of how to protect against this “DejaBlue” exploit and walk through the steps to protect your environment.

Source:: Cisco Security Notice

By Todd Reid Cisco is pleased to announce a new series of Forensic Investigation Procedures for First Responders guides that will help customers and partners triage Cisco products that are suspected of being tampered with or compromised. These guides provide step-by-step instructions for collecting information that first responders can use for forensic analysis for several different platforms, including devices that run Cisco IOS and IOS XE Software, and devices that run Cisco ASA or Firepower Threat Defense (FTD) Software.
These new documents are available on the Cisco.com Security Portal under Tactical Resources.
The following is a summary of the documents released thus far, along with a brief description of each one.
Cisco ASA Forensic Investigation Procedures for First Responders
This document provides guidance for collecting forensic evidence from the Cisco ASA 5500-X series of devices when compromise or tampering is suspected. It outlines several procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, verifying the system and running images for proper signing characteristics, checking the ROM monitor configuration for signs of remote image loading, and procedures for obtaining both a core file and the memory text segment from an ASA platform.
The document also includes a procedure for checking the integrity of the webvpn configuration for ASA deployments implementing SSL VPN.
Cisco FTD Forensic Investigation Procedures for First Responders
This document provides steps for collecting forensic information from Cisco ASA 5500-X devices running Firepower Threat Defense (FTD) Software when compromise or tampering is suspected. This document contains procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, verifying proper signing characteristics of FTD system and running images, retrieving and verifying the memory text segment, generating and retrieving both crashinfo and core files, and examining the ROM monitor settings for remote system image loading.
Cisco IOS Software Forensic Investigation Procedures for First Responders
This document provides guidance for collecting evidence from Cisco IOS devices when compromise or tampering is suspected and includes procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, examining the ROM monitor region for an upgraded image, and obtaining both a core dump of the running IOS image and the contents of the memory text region.
The document also includes a procedure that provides an alternate method of image analysis if a core dump cannot be performed on a platform that is performing mission-critical traffic forwarding.
Cisco IOS XE Software Forensic Investigation Procedures for First Responders
This document provides guidance for collecting evidence from Cisco IOS XE devices when compromise or tampering is suspected and includes procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, verifying the integrity and signing characteristics of system and running images, and exporting the text memory segment to verify the run time integrity of the IOSd process.
Dan Maunz, an Incident Manager in the CX Security Programs group contributed content for this article.

Source:: Cisco Security Notice

By Marc Blackmer We are very pleased to share the news that our Advanced Malware Protection (AMP) for Endpoints won the Approved Business Security Award from AV-Comparatives. And we’re happy about this for a couple of reasons. (Click this link to read the full report.)
Most vendors‘ marketing materials look great, your organization exists in the real world. So, having an independent third-party conduct months of testing against our technology, and us coming out a winner, helps to show the world what our customers already know: that the strength, flexibility, and ease of use of our endpoint security establishes our leadership. We have over a decade of experience in endpoint protection through Immunet (creators of AMP) and Sourcefire (creators of ClamAV).
AV-Comparatives‘ Business Main-Test Series ran from March to June and consisted of two, in-depth tests:
The Malware Protection Test
This test ran in March and consisted of having 1,311 malware samples thrown at us during that time. A passing score required a 90% or higher detection rate and this time zero false positives. We did very well scoring a 99.8% with zero false positives.
The Real-World Protection Test
The idea here was to mimic what happens in, well, the real world. This test ran from March to June and was based upon 732 test cases. The focus here was on user behaviors such as clicking malicious links, opening malicious email attachments, etc.
An efficacy score of 90% or higher and a false positive count of 100 or less were the criteria to pass this test. And, we came in with 98.9% and ranked in the lowest false positive group.
In short, AMP for Endpoints achieved test results that demonstrated a balance of strong protection rates with very low false positives. AV-Comparatives also highlighted Cisco’s broad endpoint platform support and relative ease of deployment.
Beyond antivirus
Secondly, we view this report as further evidence that the security world has moved past the legacy world of antivirus. I’m not saying antivirus doesn’t have a role to play in endpoint security. Our own ClamAV is one of the several mechanisms that AMP for Endpoints uses. What I am saying is that the ‘antivirus as a sole means of endpoint protection‘ ship has sailed – and sailed a long time ago.
The biggest problem with antivirus is that it’s not operationally efficient. That means a lower return on your investment and weaker protection of your business. Back in my IT days in the late 90s and early 2000s, antivirus was a big deal, but it was tough enough to administer when I was at a small, two-office operation let alone when I moved up a 50,000-user, global enterprise. And when the Love Letter worm hit us in 2003, that was a couple days and nights of manual remediation for our entire department, worldwide, because antivirus couldn’t remediate the problem or identify infected hosts.
Now fast forward to today’s world of fileless malware and multi-vector attacks that combine email, web, endpoints, etc. What’s antivirus going to do about those? The answer is pretty obvious.
What was surprising for me to learn recently was that the majority of organizations out there still rely on antivirus for their endpoint protection. I attribute this to deployment fatigue. Rolling out software is hard. I know. I’ve deployed my share of enterprise software. The good news about AMP for Endpoints is that we can be up and running quickly, as noted on page 28 of the AV-Comparatives report:
“Getting started with Cisco Advanced Malware Protection for Endpoints is very straightforward. The console requires no setup, and deploying the client software is quick and easy.”
The Big Picture
We believe it’s important to put our technology to the test and we feel the results speak to how our solution helps our customers protect their organizations. (I’ve included links to other real-world tests below.) We also believe that strong endpoint protection comes from being a part of an integrated security portfolio. One that dynamically shares the latest threat intelligence is the most effective way to defend against modern attacks. And we’ve designed our integrated security portfolio to do exactly that. But that’s another story for another day.
What’s next?
AV-Comparatives‘ testing is continuing through the end of the year and we are looking forward to their year-end report. Tune in here for those results.
Can’t wait for the report? Experience threat hunting with AMP for Endpoints for yourself at one of our Threat Hunting Workshops, or if you can’t wait for the event, sign up for a free trial of AMP for Endpoints at https://cisco.com/go/ampendpoints and see for yourself.
Additional reading
NSS: Achieved “Recommended” ratingMiercom: Achieved “Miercom Performance Verified” certification

Source:: Cisco Security Notice

By Cisco PSIRT This blog post was authored by Eugenio Iavarone, Cisco PSIRT.
On August 28th, 2019, Cisco published a Security Advisory titled “Cisco REST API Container for Cisco IOS XE Software Authentication Bypass Vulnerability”, disclosing an internally found vulnerability which affects the Cisco REST API container for Cisco IOS XE. An exploit could be used to bypass authentication on Cisco routers configured with the REST API support for Cisco IOS XE Software. This vulnerability was found by Cisco during internal testing.
The purpose of this post is to provide additional technical detail about the vulnerability, the specific Cisco hardware platforms that support the feature, and how the affected feature is enabled (as it is not enabled by default).
While the vulnerable code resides within the Cisco REST API container, the effects of the vulnerability, if exploited, will be experienced on the Cisco device as a whole. This is because exploiting this vulnerability could allow an attacker to submit commands through the REST API that will be executed on the affected device.
This is a good example of a “Scope Change” defined within the Common Vulnerability Scoring System (CVSS) standard.
Details
The REST API container is an application that provides a set of RESTful APIs as an alternative method to manage devices running Cisco IOS-XE Software. It is located in a virtual services container, which is a virtualized environment running on the host device. It is also referred to as a virtual machine (VM), virtual service, or container. The REST API virtual service is not a native capability within Cisco IOS XE, but it is instead delivered as an open virtual application (OVA) package file.
Only the following Cisco platforms supports the affected Cisco REST API container and are therefore potentially impacted by this vulnerability:
Cisco 4000 Series Integrated Services Routers
Cisco ASR 1000 Series Aggregation Services Routers
Cisco Cloud Services Router 1000V Series
Cisco Integrated Services Virtual Router
The Cisco REST API OVA package was bundled with the Cisco IOS XE software on releases prior to 16.7.1. Starting with Cisco IOS XE release 16.7.1, the OVA package is not bundled with the Cisco IOS XE image, instead it needs to be downloaded from Cisco’s Software Center and transferred to the Cisco device on which it is to be enabled.
Regardless if bundled with Cisco IOS XE or not, the REST API service is never enabled by default on any Cisco IOS XE release on any of the affected platforms. Customers interested in using the REST API capabilities have to first enable such capabilities on each device by completing the following steps:
1) Login to the device by using an administrator-level account (with privilege level 15)
2) Install the REST-API container by using the Cisco Virtual Manager (VMAN) CLI
3) Enter the remote-management configuration mode and configure a local TCP port that will be bind to the management interface of the REST API service
4) Configure a management interface that will be used to process HTTP requests submitted to the REST API service
5) Enable the REST-API virtual service container
To further clarify, even if the OVA package is present on the device (either because it was shipped with the Cisco IOS XE release running on the device, or was later transferred to the device local storage), the REST API is not enabled and will not accept requests until all of above steps have been completed.
Cisco has addressed this vulnerability on a new version of the REST API package (named iosxe-remote-mgmt.16.09.03.ova) which is available for download from the Software Center. All future REST API packages will include this fix.
Cisco has also implemented additional safeguards in all future Cisco IOS XE releases that will prevent installation of a vulnerable OVA package, and which also prevent activation of an existing, already configured and vulnerable OVA package on a device.
In order for a device to be considered vulnerable, all of the following conditions must be met:
A REST API OVA package with a version below 16.9.3 must be present on the device local storage
The REST API virtual service is installed
The REST API virtual service is configured
The REST API virtual service is enabled
A device meeting some of the previous conditions, but not all of them, is considered not vulnerable.
Additional information can be found on the associated Cisco Security Advisory available at:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-iosxe-rest-auth-bypass
Conclusion
While this is a serious vulnerability that should be carefully assessed by customers to determine exposure and impact on their environment, the scope of affected Cisco customer base is contained by the limited number of Cisco hardware platforms supporting the feature and the fact the affected feature is not enabled by default.
Customers fulfilling all of the conditions above listed are recommended to review the advisory and take appropriate actions. Although, this vulnerability was found by Cisco during internal testing; our commitment to customers is to be open and transparent, especially as it relates to issues that could negatively impact their business. At Cisco, we always strive to clearly communicate with customers about technical or other issues that could potentially expose their organizations to risk.

Source:: Cisco Security Notice