CISA issues urgent alert on Windows vulnerability CVE-2024-26169 exploited by ransomware. Immediate patching required to prevent SYSTEM-level attacks
Continue reading
On March 12, 2024, Microsoft addressed a high-severity vulnerability, CVE-2024-26169, during its monthly Patch Tuesday updates.
This vulnerability, stemming from an improper privilege management weakness in the Windows Error Reporting service, has been actively exploited by ransomware groups, particularly the Black Basta gang.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added this flaw to its catalog of actively exploited security bugs, urging immediate action.
CVE-2024-26169 is a critical security flaw caused by improper privilege management in the Windows Error Reporting service. This flaw allows local attackers to gain SYSTEM permissions through low-complexity attacks that do not require user interaction. Such vulnerabilities are particularly dangerous as they provide attackers with elevated privileges, enabling them to execute arbitrary code, install programs, view, change, or delete data, or create new accounts with full user rights.
*Sample instance code illustrating a potential exploit scenario*
This sample code highlights the type of manipulation that could be performed using elevated privileges obtained through this vulnerability.
Symantec security researchers discovered that the Black Basta ransomware gang (also known as the Cardinal cybercrime group) exploited this vulnerability. They found evidence suggesting that the group had developed a working exploit as early as December 18, 2023. This implies that the attackers had a functional exploit at least 85 days before Microsoft released a patch.
One with a compilation timestamp of February 27, 2024. Another built earlier, on December 18, 2023. The timestamps on the exploit tools indicated two primary builds: one from December 18, 2023, and another from February 27, 2024. Despite the possibility of tampering with these timestamps, Symantec believes the evidence is reliable. The early possession of the exploit by Black Basta signifies a considerable threat, given their history of targeting high-profile organizations.
The timestamps, though potentially modifiable, suggest a prolonged period of exploitation, possibly spanning 85 days before Microsoft's patch release.
December 18, 2023: Earliest known compilation of the exploit. February 27, 2024: Second compilation of the exploit. March 12, 2024: Microsoft releases Patch Tuesday updates addressing the vulnerability. May 2024: Symantec publishes findings linking Black Basta to the exploitation.
Black Basta has a notorious track record of breaching significant entities, including government contractors, healthcare giants, and critical infrastructure sectors. The exploitation of CVE-2024-26169 enables attackers to infiltrate systems with minimal effort, bypassing security measures and gaining control over sensitive data.
Black Basta, active since April 2022, has a history of targeting high-profile organizations. Notable victims include:
The SYSTEM-level access provided by CVE-2024-26169 allows attackers to:
The operational and financial damage from such attacks is profound, encompassing business disruption, data loss, and significant recovery costs.
The SYSTEM-level access provided by this vulnerability allows attackers to execute ransomware attacks effectively. They can encrypt vital data, disrupt operations, and demand hefty ransoms. The financial and operational impact on affected organizations can be devastating, often leading to loss of business, reputational damage, and significant recovery costs.
In response to the exploitation of this vulnerability, CISA issued a directive mandating Federal Civilian Executive Branch (FCEB) agencies to secure their systems by July 4, 2024. This directive, while only binding for federal agencies, strongly urges all organizations to prioritize fixing this flaw to mitigate risks.
Organizations must prioritize applying the March 2024 Patch Tuesday updates from Microsoft. These patches address the CVE-2024-26169 vulnerability, closing the exploit path for attackers.
Beyond patching, organizations should implement system hardening measures, including:
Organizations should adopt a multi-layered security approach to enhance their resilience against such vulnerabilities. Key strategies include:
Below is a PowerShell script to check and ensure that the Windows Error Reporting service is properly configured and patched:
*Verify and update Windows Error Reporting service*
This script ensures that the critical patch addressing CVE-2024-26169 is applied, thereby mitigating the risk of exploitation.
The addition of CVE-2024-26169 to CISA's catalog of actively exploited vulnerabilities underscores the critical nature of this security flaw.
The swift action required by federal agencies and recommended for all organizations highlights the severity of the threat posed by ransomware groups like Black Basta.
148 malicious npm packages masquerading as student proxy and school Wi-Fi bypass tools. Rather than compromising developers during installation
