Zerologon is another term we should associate with cyberattacks. It is one of the vulnerabilities that sent shockwaves through the entire IT community. Zerologon refers to a security flaw in Microsoft software. Let’s take a closer look at what it actually is.
Zerologon – what is it?
Zerologon is a security vulnerability that was assigned the identifier
CVE-2020-1472. It concerns the cryptographic security of Microsoft’s Netlogon process. Its root cause lies in the logon process, where the initialization vector should be a random number — but in this case it was hardcoded to a fixed value made up entirely of zeros. The flaw received the maximum severity rating, 10/10. Zerologon exploits the cryptographic scheme used in the Microsoft Active Directory Netlogon Remote Protocol, which lets an attacker log in to servers relying on the NTLM protocol. This allows a hacker to impersonate any computer, including the primary domain controller. A cybercriminal can very easily take over Windows servers running on corporate networks. The vulnerability went largely unreported for months, until a Dutch security firm published a technical report describing exactly what the CVE-2020-1472 flaw is.
Zerologon attack
As already mentioned, the vulnerability lets a hacker seize control of a domain controller, including the primary domain controller. To carry out the attack, it’s enough to change or delete the password of the controller’s service account, giving the cybercriminal control over the entire network. Exploiting the CVE-2020-1472 vulnerability requires establishing a TCP session with the domain controller. When an attacker is physically present on the network, they may have access to the company’s open port. This means the attacker can also carry out the attack from outside the network if they gain access to a point from which they can establish a TCP session with the controller. The researcher who discovered the vulnerability showed that one in 256 keys produces a cipher made up entirely of zeros. As you might guess, generating a cipher of all zeros using such a small number of keys is very simple, and takes a computer only a few seconds. In practice, this means an attacker needs only 256 attempts to obtain login credentials or a client’s network password. In the case of a computer or machine account, the number of password attempts is unlimited, letting a hacker run a virtually unlimited number of attempts in a very short time.
Fixing the Zerologon vulnerability
Microsoft began working on the vulnerability and releasing patches to eliminate Zerologon. The company also urged customers to update their Active Directory servers immediately. Even so, it is estimated that the average time between the patch’s release and its installation was around five months, and the patch didn’t resolve every issue. Microsoft introduced a secure channel access mode that all devices were meant to use; otherwise, they would be denied access. With vulnerabilities like this, network security deserves special attention. The simplest place to start is with traditional security measures, such as monitoring account and network activity to detect malicious traffic. The next step is intrusion prevention systems and anti-malware software, which give you visibility into ransomware, viruses, and other threats. If an attack has already occurred, a fast response is essential to limit the damage and prevent similar incidents in the future. Carrying out these actions requires a team with the right expertise. Specialists can perform this work for a company as part of a post-incident forensic analysis service. This is an essential response to an attack in which company data has been compromised.
Zerologon changed the rules of the game for attackers, proving to be a simple attack to carry out with very serious and damaging consequences. IT departments scrambled to respond to the vulnerability as quickly as possible, but it managed to cause substantial damage before security patches were fully rolled out.