Governance & Risk Management , IT Risk Management , Patch Management

100,000 Windows Devices Still Exposed to SMBGhost Flaw

COVID-19 Distractions May Have Delayed Patching, Experts Say
100,000 Windows Devices Still Exposed to SMBGhost Flaw
Taiwan, Japan and Russia are where most of the unpatched systems reside. (Source: Jan Kopriva)

Almost eight months after Microsoft warned of a critical vulnerability in Windows called SMBGhost, more than 100,000 unpatched devices remain vulnerable to this flaw, according to security researchers. The bug, tracked as CVE-2020-0796, carries a CVSS 10.0 critical rating.

See Also: Live Webinar | Securing Mobile Endpoints to Protect IP in the Pharma Industry

A hacker who exploited the vulnerability could potentially remotely execute code.

Even though Microsoft issued a patch for the SMBGhost vulnerability after it was disclosed in March, security experts note that the COVID-19 pandemic and ensuing rush to move workers into home offices may have led to delays in applying the fix.

"While there were no difficult steps involved in patching the vulnerability, the timing of the disclosure and the affected versions of Windows may have played a part in the large number of unpatched systems," Rody Quinlan, security response manager at Tenable, tells Information Security Media Group.

Based on data gathered using the Shodan search engine, which can scan for open ports that are vulnerable to a specific threat, about 103,000 Windows machines worldwide remain vulnerable to CVE-2020-0796, says Jan Kopriva, CSIRT senior lead at the Czech security firm Alef Nula. Kopriva published his findings in a SANS ICS Security report issued Thursday.

Some Confusion?

Kopriva notes Microsoft's patch was issued as an out-of-band update and not on Patch Tuesday, which may have caused some confusion (see: Microsoft Patches Wormable SMBv3 Flaw).

The timing of the March 13 patch coincided with the start of the COVID-19 shutdown and the move to a remote workforce. "At that time and to date, IT administrators have likely been focused on implementing and maintaining an infrastructure for remote working as well as maintaining existing systems remotely," Quinlan says. "This move would have impacted normal patching cycles as organizations loosened the reins and got creative with patching over VPN. Unfortunately, some patches are so expansive they can have an impact on VPN bandwidth."

Another issue may be poor cybersecurity hygiene, Kopriva notes.

"Just exposing [Server Message Block] to the internet goes against good security practice, so it would make some sense that people who don't configure their firewalls properly wouldn't patch their systems either," he says.

SMBGhost

The vulnerability CVE-2020-0796 is related to the way that the Microsoft Server Message Block 3.1.1 protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client, according to the Microsoft alert from March.

To exploit the vulnerability in a server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability in a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it, according to Microsoft.

Following the vulnerability disclosure in March, proof-of-concepts attacks designed to exploit CVE-2020-0796 were released in June. After the release, several successful attacks were executed, according to the U.S. Cybersecurity and Infrastructure Security Agency.

CISA recommends using a firewall to block SMB ports until the patch can be applied.


About the Author

Doug Olenick

Doug Olenick

News Editor, ISMG

Olenick has covered the cybersecurity and computer technology sectors for more than 25 years. Prior to joining ISMG as news editor, Olenick was online editor for SC Media, where he covered every aspect of the cybersecurity industry and managed the brand's online presence. Earlier, he worked at TWICE - This Week in Consumer Electronics - for 15 years. He also has contributed to Forbes.com, TheStreet and Mainstreet.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing databreachtoday.com, you agree to our use of cookies.