Pulse VPN patched their vulnerability, but businesses are trailing behind
Credit to Author: Pieter Arntz| Date: Fri, 18 Oct 2019 16:36:36 +0000
In April 2019, Pulse Secure published an advisory about a vulnerability in their software. In August, cybercriminals were massively scanning for systems that were running a vulnerable version. Now it’s October, and still many organizations have not applied the patches that are available for this vulnerability.
This is a trend we’ve seen repeated with dozens of other publicly-known vulnerabilities and organizations that are slow to update software to the latest, most secure versions.
With so many organizations falling victim to cyberattack via exploited vulnerability, we have to ask: Why aren’t people patching?
What are the vulnerabilities?
Reading the above, you might suspect that the vulnerabilities were not serious or hard to exploit. But that’s not the impression we get from the Pulse Secure advisory. It states:
“Multiple vulnerabilities were discovered and have been resolved in Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS). This includes an authentication by-pass vulnerability that can allow an unauthenticated user to perform a remote arbitrary file access on the Pulse Connect Secure gateway. This advisory also includes a remote code execution vulnerability that can allow an authenticated administrator to perform remote code execution on Pulse Connect Secure and Pulse Policy Secure gateways.”
Pulse Connect Secure is a VPN solution for organizations and offers remote users a secure connection to the corporate network so they can remotely log in and work. Pulse Policy Secure is a well-known Network Access Control solution, which does not only control who can connect but also assigns the appropriate permissions.
When it comes to software like this, an authentication by-pass vulnerability is a serious problem. Any criminal with the proper knowledge can pretend to be an employee and access company resources. In this case, https access and the use of an especially-prepared URL would be enough to read an arbitrary file on a vulnerable system.
Needless to say, that is a serious problem—and we haven’t even touched on the remote code execution possibility. Every hacker’s dream is to be able to run their code on your system. That gives them a foothold within your network from which they can expand their activities. They can plant ransomware or whatever else they fancy.
Where would they get the necessary knowledge
By design, many cybercriminals are opportunistic, and they will jump at any easy copy-and-paste job that renders enough cash. So, when the vulnerability was discussed elaborately at Black Hat in early August, the method to exploit the vulnerability became general knowledge.
Since using this method hardly requires expert knowledge, researchers soon noticed a lot of scanning activity by cybercriminals looking for vulnerable systems. The vulnerability in Pulse Secure was presented along with a few vulnerabilities in other SSL VPN products. Shortly after, an exploit for this vulnerability was published on GitHub, so every copycat could have it handy.
Unpatched
On Saturday, August 24, 2019, scans performed by Bad Packets found a total of 14,528 Pulse Secure VPN endpoints vulnerable to CVE-2019-11510. Over 5,000 of those were in the US, including military, federal, state, and local government agencies.
A week later, 10,471 Pulse Secure VPN servers worldwide remained vulnerable to compromise. On Monday, September 16, 2019, there were still 7,712 left to be patched. On Monday, October 7, 2019, a surprising 6,018 remained, with a lot of active scanning going on—and this was after advisories have been issued by the NSA and the NCSC.
Responsibility
A basic question in cases like these is: Who is responsible for applying patches? Without doubt, we expect a vendor to develop a patch as soon as the vulnerability is made known to them, but what happens after that?
Industry leaders have long warned that vulnerability remediation and effective patch management are essential to keep organizations safe from cyberattacks. But there are a few essential steps in the delivery chain after the patch is released:
- Customers need to be made aware of the patch and the required urgency.
- Security providers or resellers need to make sure their customers are aware of the existence of the patch and the possible consequences of not applying it.
- Organizations need to have a department or external provider that is responsible for keeping the security software updated. Spending money on top-notch software and then leaving it unattended is a sure waste of money. Keeping software in shape is not limited to applying patches, but security patches can sometimes be more important than fetching the latest rules update.
The natural next question, then, is why aren’t organizations applying patches as soon as they know about them?
Recommended reading: Tackling the shortage in skilled IT staff: whole team security
So, what’s stopping them from applying the patch?
Assuming that an organization’s IT or security team is aware of the patch, possible reasons for holding off might be fear of disrupted processes or a possible disagreement on what they might regard as critical. But the possible consequences of an unpatched critical vulnerability should heavily outweigh those concerns.
There could be several other reasons for not applying patches as soon as they are available:
- Understaffed IT and security teams
- Looking into the consequences first, which could slow down the process due to lack of feedback
- Waiting for others to share their experiences before applying patches
- Unaware of the patch’s existence, sometimes as a result of not having time to follow up on emails and warning signs
- Lack of a point of contact. Whose problem is it? And whose job is to solve it?
As you can see, most of these can be traced back to a lack of staff and time, and sometimes funding is responsible for those two shortages. But sometimes understaffing is because of other reasons. And once you are understaffed, the lack of time to follow up on problems comes as a logical consequence.
The Pulse vulnerability is not alone
It’s not like the Pulse vulnerability is the only VPN-related vulnerability out there (or any software vulnerability, for that matter). Similar problems are known to exist in products from Fortinet and Palo Alto.
In an advisory from the National Cyber Security Center (NCSC) in the UK, users of the affected VPN products can find specified log entries to look for signs of a compromise or attempt to compromise. They also emphasize the need for patching:
“Security patches should always be applied promptly. More guidance is available on the NCSC website. The NCSC acknowledges that patching is not always straightforward and in some cases can cause business disruption, but it remains the single most important step an organisation or individual can take to protect itself.”
So, the question remains: If organizations are aware of the patch and have the staff resources to apply it, why are so many dragging their feet? Maybe some of our readers can shed some light on this mystery. Feel free to share your personal experiences in the comments.
The post Pulse VPN patched their vulnerability, but businesses are trailing behind appeared first on Malwarebytes Labs.