KL Technologies, 성공적인 사업 파트너


전 체 [ 126 ]
구매 및 체험 문의 [ 3 ]회원등록 [ 0 ]
보안 및 제품 정보 [ 7 ]바이러스 문제 [ 4 ]
설치 및 제거 [ 21 ]제품 설정 [ 57 ]
트러블슈팅 [ 14 ]Kaspersky Rescue Disk [ 1 ]
Kaspersky Security Scan [ 13 ]기타문의 [ 2 ]

   
  [공지 > ] 170512 SMB 취약점을 악용한 랜섬웨어 대응 안내

안녕하세요.

케이엘테크놀로지입니다.

최근 SMB 취약점을 악용한 랜섬웨어는 쉐도우 브로커스'(Shadow Brokers)의 소행으로 보여지고 있는데 카스퍼스키랩에서는 이미 15년도에 최초 발견하여 업데이트를 해오고 있었습니다:

카스퍼스키랩은 4  14 일 섀도우 브로커스 (Shadow Brokers) 그룹이 발표 한 새로운 아카이브에 대하여 발표하였습니다분석 결과에 따르면 아카이브에 악성 프로그램이 포함되어 있으며 그 중 다수가 카스퍼스키 랩의 제품에 의해 사전에 탐지되었습니다여기에는 Equation group’s EQUATIONDRUG  GRAYFISH 플랫폼이 포함되며, 카스퍼스키랩에서 2015 년에 처음 발견되었습니다 . 또한 이 아카이브에는 여러 Microsoft 제품 및 플랫폼을 대상으로 하는 문서 및 악용 사례도 포함되어 있습니다. 

분석 결과를 바탕으로 카스퍼스키랩의 솔루션이 현재 게시 된 자료에 포함 된 모든 위협을 탐지하고 있음을 알려드릴 수 있습니다. 

Microsoft에서 제공하는 기술 블로그 게시물에 따르면 공식적으로 지원되는 Microsoft 제품 및 최신 보안 패치가 설치된 플랫폼은 게시 된 패키지에서 언급 된 취약점으로부터 안전합니다. Microsoft 사용자는 공급 업체로부터 최신 패치를 설치하는 것이 좋습니다특히 2017  3  14 일에 릴리스 된 패치가 가장 중요합니다.

이 릴리스와 관련된 위협에 대해 카스퍼스키랩에서 추가한 탐지 이름은 다음과 같습니다. 

Exploit Name

MS Bulletin

Detection Signatures

Notes

1.

“EternalBlue”

MS17-010

Exploit.Win32/64.ShadowBrokers.*

UDS:DangerousObject.Multi.Generic

SMBv2 Exploitation Tool, RCE.

The vulnerability was fixed by Microsoft on March 14, 2017.

We detect the exploitation tools and are investigating this vulnerability further to create generic defense mechanisms against similar attacks in the future.

2.

“EmeraldThread”

MS10-061

Trojan.Win32/64.EquationDrug.*

Exploit.Win32.RPC.*

Intrusion.Win.CVE‑2010‑2729.a.exploit

UDS:DangerousObject.Multi.Generic

Printer Spooler vulnerability.

This vulnerability was used by the well-known Stuxnet worm; the first exploit for this vulnerability was published in 2010, so this is a well-known issue. This vulnerability was addressed by MS10-061 on September 14, 2010.

We have been detecting the exploitation of this vulnerability since 2010.

3.

“EternalChampion”

CVE‑2017‑0146

CVE‑2017‑0147

Exploit.Win32/64.ShadowBrokers.*

UDS:DangerousObject.Multi.Generic

(CVE-2017-0146) This SMBv1 server exploit allows remote attackers to execute arbitrary code via specially crafted packets, aka "Windows SMB Remote Code Execution Vulnerability".

(CVE-2017-0147) This SMBv1 server exploit allows remote attackers to obtain sensitive information from the process memory via crafted packets, aka "Windows SMB Information Disclosure Vulnerability".

We detect the exploitation tools and are investigating these vulnerabilities further to create generic defense mechanisms against similar attacks in the future.

4.

“ErraticGopher”

Addressed prior to the release of Windows Vista

Trojan.Win32/64.EquationDrug.*

Trojan.Win32/64.ShadowBrokers.*

UDS:DangerousObject.Multi.Generic

SMBv1 exploit targeting Windows XP and Server 2003.

We detect the exploitation tools and are investigating this vulnerability.

5.

“EsikmoRoll”

MS14-068

UDS:DangerousObject.Multi.Generic

Kerberos exploit targeting Windows 2000, 2003, 2008 and 2008 R2 domain controllers.

This is well-known vulnerability, It was addressed by MS14-068 on 11/18/2014. 
We detect exploitation tools and we are deeply investigating this vulnerability to create generic defense mechanisms against similar attacks in the future.

6.

“EternalRomance”

MS17-010

Trojan.Win32/64.ShadowBrokers.*

UDS:DangerousObject.Multi.Generic

SMBv1 exploit over TCP port 445 which targets Windows XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2 and gives SYSTEM privileges.

The vulnerability was fixed by Microsoft on March 14, 2017.

We detect the exploitation tools and are further investigating this vulnerability.

7.

“EducatedScholar”

MS09-050

Exploit.Win32.CVE-2009-3103.*

Trojan.Win32/64.EquationDrug.*

Intrusion.Win.SMB.CVE-2009-3103.exploit

UDS:DangerousObject.Multi.Generic

Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service.

This is a well-known vulnerability; it was addressed by the MS09-050 bulletin on 10/14/2009.

We have been detecting the exploitation of this vulnerability since 2009.

8.

“EternalSynergy”

MS17-010

Trojan.Win32/64.ShadowBrokers.*

UDS:DangerousObject.Multi.Generic

SMBv3 remote code execution flaw for Windows 8 and Server 2012 SP0.

The vulnerability was fixed by Microsoft on March 14, 2017.

We detect the exploitation tools and are further investigating this vulnerability.

9.

“EclipsedWing”

MS08-067

Exploit.Win32/64.ShadowBrokers.*

Trojan.Win32/64.EquationDrug.*

UDS:DangerousObject.Multi.Generic

This is the well-known vulnerability (CVE-2008-4250) server service RCE.

It was addressed by the MS08-067 bulletin on 10/23/2008.

We detect the exploitation tools and are further investigating this vulnerability.

10.

“Englishmansdentist”

-

Trojan.Win32/64.ShadowBrokers.*

Sets Outlook Exchange WebAccess rules to trigger executable code on the client's side to send an email to other users.

We detect the exploitation tools and are investigating this further.

11.

“EsteemAudit”

-

Trojan.Win32/64.ShadowBrokers.*

Microsoft RDP exploit and backdoor for Windows Server 2003.

We detect the exploitation tools and are further investigating this vulnerability.

12.

“ExplodingCan”

-

Trojan.Win32/64.ShadowBrokers.*

Microsoft IIS 6.0 exploit that creates a remote backdoor.

We detect the exploit tools and are further investigating this vulnerability.

윈도우 보안 업데이트를 받을 수 없는 Windows 7 이하에 OS는 꼭 OS를 업그레이드 하시기 바랍니다.

XP, 8 그리고 2003의 경우 아래 링크에서 보안 업데이트를 받아 주시기 바랍니다.
http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598


감사합니다.



관리자   17-05-13 20:57
윈도우 보안 패치와 관련된 내용은 아래 블로그를 참조하시기 바랍니다.
https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/