I’ve travelled all over the internet, I’ve worked with logs of organisations from banks through to small ISVs and one thing I would say is fairly universally true. What can be isn’t what is.
There’s a lot of different operating models and technologies in the world. There’s logs of differen’t specifics. This diagram here is not mean’t as a refrence architecture but more as an indicator.
There is also a massive reality people must understand, cyber good most definatley costs more at the point of deployment than cyber bad. Cyber bad’s ROI is truly variable and in mind mind is too hard to measure. For one org with cyber bad can experiance a significant breach (and cost) and another may have lady luck on their side.
It’s crude so also look for the modified timestamps, recent unexpected blast service restarts and if you have process logging go and check for suspicious child processes over the period. Once you have checked, run a backup, then if they aren’t patched, patch the servers! (i know patching isn’t as simple as just patch!)
Introduction
In Decemebr a critical vulnerability (created by a feature request) in Log4J was discovered (named Log4Shell), unveiling the reality that an enormous amount of products may be vulnrable to a relativley simple remote code execution vulnerability (which includs a huge range of internet facing systems, such as vmware horizon).
I’m going to be vaugue here on purpose, mainly because I’m not omnipotent and the scale of the challenge here is significnatly large that it’s subject to change. The constant phrase with log4shell is “dynamic and evolving”. To be blunt, the intel we are getting is changing very rapdily from both a threat and vulnerability perspective.
The Log4J scenario to some is a non event, but when we look at this at scale and when we look at certainly technology stacks it has really serious poential for negative impact. Public facing services such as:
VMware Horizon
VMware Vcenter (don’t ask why people put this online but it seems lots them do!)
VMware Worksapce One
Mobile Iron
Unifi
Citrix XenMobile
Fidelis commandpost
For a list of currently known affected products please see:
As you can see there are potentially one or two horizon services exposed! (let alone vcenters)
Timeline
Eraly December ~9th Decemeber 2021 the vulnerability was publically disclosed
12/12/2021 – Vmware publishes KB to partially address the vulnerability (workaround) on vmware horizon (https://kb.vmware.com/s/article/87081) – this has been updated all through December
The Log4J Payloads into the web services aren’t so easy to detect. They will basically look like standard traffic and without full packet captures and TLS inspection you almost certainly (based on research in the lab) see the malicious payloads.
You will in the logs however see error events, so there will be a ton of logs in the UAGs and Connection server logs that occur when a failed attempt to exploit log4j occurs.
In short (but subject to loads of configuration and environmental variance) we have found:
In the standard vmware logs you will largely not see exploitation. You will likely see failed exploitaiton attempts. There are some logs which show a connection but the metadata is limited. E.g. it will hav source IP, time and path however depending upon your load balancer configurations you may just see the UAG connect to the Connection server and access a path used in normal operations.
Process Logging
Process logging in sysmon will show excution of both log4j when the java child processes are spawned. It however possible that a malicious class load could run in memory and use native win32 APIs and NOT spawn a child process (we haven’t tested that yet).
Backdoor
Backdoors can be detected by looking for file modifications here: (default path) C:\Program Files\VMware\VMware View\Server\appblastgateway\lib
The script I knocked up is crude but will detect the activity seen recently in the wild.
In our testing we have found the stamps on all files should be the same, a file with a different date has likely been modified in a suspicious manner.
Microsoft Defender for Endpoint
These queries can be narrowed down and you should filter these onto your specific Horizon infrastrcuture, so they are examples for guidance, you will likely need to do some tweaks and mods:
Log4J (TCP 443) child process creations (check for benign normal child processes)
Look for evil using powershell etc.
DeviceProcessEvents
| where DeviceName has_any("horizon-con-001") //connection server name
| where InitiatingProcessParentFileName == @"ws_TomcatService.exe"
| order by Timestamp desc
Check for backdoors being created by powershell for file modification events:
DeviceFileEvents
| where FileName has_any("absg")
| where FolderPath has_any("appblastgateway")
| where ActionType == "FileModified"
| where InitiatingProcessCommandLine has_any("powershell")
| order by Timestamp desc
Check network connections from ws_TomcatService.exe
DeviceNetworkEvents
| where DeviceName has_any("horizon-con-001")
| where InitiatingProcessCommandLine == @"""ws_TomcatService.exe"" -SCMStartup TomcatService"
| where RemoteIP != @"127.0.0.1"
| where ActionType == @"ConnectionSuccess"
Please note that in our lab testing we do not see all the connections in MDE. So this data is deemed to be incomplete:
Backdoor Usage (TCP 8443)
The backdoor seen is in absg-worker.js (but remember the log4j rce here could be used in many many ways:
You can see in this instance the modified date looking quite out of place against the files peers.
DeviceProcessEvents
| where DeviceName has_any("horizon-con-001") //connection server name
| where InitiatingProcessParentFileName == @"node.exe"
| order by Timestamp desc
In our limited testing we can see backdoor usage whch spawns child processes from node.exe
We should also note both in the lab and in the wild we have seen the following:
A very simmilar message is logged on the connection server when a failed backdoor attempt is made. This can be found in:
EDR Process Logging (process launches, file writes)
Load Balancer HTTP Traffic Logs
Connection Server debug logs and blast logs
Firewall (ingress and egress traffic logs)
UAG blast logs
DNS Logs (however we are seeing threat actors use IP addresses for the LDAP call backs)
Vmware Horizon Log Levels
In the lab we observed the following:
By default the UAG log level was set to INFO
Debug logging is set on the connection server (assumed based on filename)
With INFO logging on the UAG we weren’t able to determine if a malicious payload had been sent. In the ESMANAGER log successful connections were not logged.
We could see the connection on the backend connection server however we could not determine this was a malicous payload in the default logging configuration.
in DEBUG mode we could see the connections and PALOADS on the UAG.
Exploitation Entry Points
There are at least two pages on the HTML Access services that are vulnerable when ther server are unpatched:
/broker/xml
/portal/info.jsp
Please note we’ve had mixed results with /brokes/xml which may be build version specific.
Threat Intel
Micosoft has reported DEV-0401 using Log4Shell in relation to ransomware activity:
We have observed a China-based ransomware operator that we’re tracking as DEV-0401 exploiting the CVE-2021-44228 vulnerability in Log4j 2 (aka #log4shell) targeting internet-facing systems running VMWare Horizon. https://t.co/6GOdRwRTjk
— Microsoft Security Intelligence (@MsftSecIntel) January 11, 2022
Advisory
This post will likely be updated, it’s not a step by step of how to find all the evil but it hopefully will help identify malcious activity seen in the real world. We will update this if new intel comes in.
Also if you want to wite nicer detections feel free 🙂 these are just examples and are by no means the only ways to do this!
Exploitation Tutorial
When people have had more time to patch and the landscape looks better we will blog how to exploit this and talk about why the currently known backdoor has some limitations due to the service architecture and how the backdoor has been created. It’s important to share exploitation knowledge but there are things to consider, if you are sharing exploitation without detection rules / tools this creates a risk to people. VMware products and services are leveraged by organisations worldwide and the log4j RCE on hoirzon let alone the backdoor can be leveraged for high impact actions by threat actors.
Thanks
Thanks to everyone in the community and industry who has and is helping, thanks to all of those who have stayed up late, missed familty events and generally been super helpful either indirectly or directly. There are lots of people involved in this world who everyday work to keep people safe! (also to my friends and family who have put up with my not being round much!).
If you have a business email compromise incident and you haven’t deteced it in a timely manner your fist notification might be a bad experiance, the threat actors may have commited fraud, attemped fraud or simply launched a phishing If you have a business email compromise incident and you haven’t detected it in a timely manner your fist notification might be a bad experience, the threat actors may have committed fraud, attempted fraud, or simply launched a phishing campaign from your environment. If you are in this position, there are some steps you can take from a technical point of view to limit impact and reduce risk of a re-occurrence. This blog is a high-level view at some of the tactical and longer-term activities you can conduct.
This is part of a series I’m writing which is focusing on some of the core fundamentals of why cyber security is a business issue, why business leadership should care and invest in a good security posture and I’m looking at common security threats and ways you can combat these. Read more “I’m the CEO why do I care about phishing threats?”→
First and foremost, I’m going to start by saying if I include any cliché quotes it’s probably in an ironic context or used to show how they aren’t practically useful. Why are we here? Well, based on the title, it’s because you are either a CEO/MD or you are in a leadership position and want to learn a little more about cyber security.
I’m sure you have read the news, I’m sure you have seen vendor adverts explaining something like:
Zero Trust
The Security Skills Gap
How phishing can be solved through security awareness training (pro tip: it can’t)
And I’m sure someone on your LinkedIn feed you have seen people exclaim all kinds of crazy things like:
TLS Weaknesses Lead to Ransomware
Security is Simple (it, I’m afraid, is not)
Managed Security Service Providers ensure security
“Security education and awareness darling, it’s all the rage! It’s simply to hot right now.” Ok stop, let’s take a minute to get some context. It’s the year 2021, organisations are taking a battering round the globe from cyber criminals who are deploying ransomware, extortion, and fraud via a range of methods but one you can’t not have heard of is phishing.
In this post today, I’m going to look at realities of initial access, phishing and some questions I think people should be asking themselves about the idea of phishing their own userbase. I try and look at this from multiple perspectives because I think it’s a complex subject. Let’s start with initial access methods!
Common Patterns of Access
If we look at the world of technology and cyber security, you will see logs of references to frameworks and language that is enough to send even the committed to sleep! However, let’s abstract from our TTPs, our MITRE ATT&CK frameworks and our “threat actors” and let’s talk in normal English. Read more “Phishing your own people – path to eroding trust or a useful tool?”→
Sales darling, it’s all about sales. It’s a harsh but true part of the world where you need to be able to sell. I’m not talking about business to business or hunters, farmers etc. I’m talking about being able to sell to someone that you are the right person to help them and their organisation.
Now this isn’t easy in the middle or tail end of a career let alone when you are starting off. But let’s for a minute role play and look at what I would do if I was new to the cyber world and was looking for a role?
Imagine the scenario where you have an endpoint or server running and you don’t have centralised logging or visualisation of log data and you need to perform some rapid analysis without wanting to stand up a new set of VMs or services, well this is where cloud really can come into it’s own.
Human Interface Devices is the science way of saying (in this case) keyboard! Now that doesn’t sound amazing but then we look at the details. What we are talking about here is a wireless remote controlled programable keyboard emulator disguised as a USB cable or a cable between a real USB keyboard (must be detachable). This provides attack opportunities to both key log and hijack inputs to PC devices covertly and remotely (within WIFI range). Just imagine what you could do with one of these.
Architecture
